index=YOUR_NETSCALER_INDEX host="YOUR_NETSCALER_HOST" earliest=-7d latest=now
"pitboss" "NSPPE" "unexpectedly died"
| table _time host source sourcetype _raw
| sort -_time
| head 200