I want to get a portion of the string in NRQL.
I have attribute in my logs like below. the attribute name is message.
[ERW0001] some error messages…
The ERW0001 is a error code.
I want group by error code to count errors.
My NRSQL like below.
select count(*) form Log Since 1 hour ago where level = ‘ERROR’ FACET SUBSTR(message,1,7) extrapolate
but the SUBSTR() function not support NRQL.
In the NRQL ,how to get a portion of the string?