index="REPLACE_WITH_WEB_INDEX" sourcetype="REPLACE_WITH_ERROR_LOG_SOURCETYPE" earliest="10/20/2026:00:00:00"
    (("Allowed memory size" "Unknown on line 0") OR "exited on signal 11" OR "Segmentation fault")
| eval signal=if(like(_raw, "%Allowed memory size%"), "startup memory fatal", "worker crash")
| bin _time span=10m
| stats count AS events earliest(_time) AS first_seen latest(_time) AS last_seen values(source) AS sources BY _time host signal
| sort 0 first_seen