Update savedsearches.conf

Author: gjanders

default/savedsearches.conf

@@ -6525,6 +6525,7 @@ OR (component=CMPeer "Bundle validation failure reported") OR ``` CsvLineBreaker
 | rex field=message mode=sed "s/bid=\S+/bid=?/" \
 | rex field=message mode=sed "s/JSON parse error at offset \d+ of file \".*? Unexpected/JSON parse error at offset <x> of file: Unexpected/" \
 | rex field=message mode=sed "s/Possible duplication of events with channel=.*?,\s+.*?host=/Possible duplication of events with channel=removed_by_sed host=/" \
+| rex field=message mode=sed "s/Unable to write to destination=(\S+) url=(.*?)\/20[23]\d\/.*/Unable to write to destination=\1 url=\2/" \
 | eval search_head=host \
 | eval search_head_cluster=`search_head_cluster` \
 | stats count, latest(_time) AS mostrecent, earliest(_time) AS firstseen, values(component) AS component, values(log_level) AS log_level by message, search_head_cluster \