topic use strings values as a variable to do stats in Security

use strings values as a variable to do stats

gsbpp — Tue, 28 Oct 2025 18:26:49 GMT

index=myindex ( "Sign-up experience experiment not allowed" OR "Sign-up experience experiment allowed" OR "experiments.1" )

SO, there are three string searches; the first tow differ in a "not" inside the text.

I would like to do a stats to count for the appearance of each, e.g.

| stats count by <var>

Re: use strings values as a variable to do stats

richgalloway — Tue, 28 Oct 2025 19:11:13 GMT

If the searched-for strings are in a known field then you can use that field in the stats command.

index=myindex ( "Sign-up experience experiment not allowed" OR "Sign-up experience experiment allowed" OR "experiments.1" ) | stats count by foo

OTOH, if the strings can be anywhere then it gets more involved. We need to create a field for the stats command to use.

index=myindex ( "Sign-up experience experiment not allowed" OR "Sign-up experience experiment allowed" OR "experiments.1" ) | eval foo=case(searchmatch("Sign-up experience experiment not allowed"),"Not allowed", searchmatch("Sign-up experience experiment allowed"), "Allowed", searchmatch("experiments.1"), "Experiments", 1==1, "Other" ) | stats count by foo

Re: use strings values as a variable to do stats

PrewinThomas — Wed, 29 Oct 2025 06:01:17 GMT

@gsbpp
You can try something below to match and do a stats count.

index=myindex ( "Sign-up experience experiment not allowed" OR "Sign-up experience experiment allowed" OR "experiments.1" ) | eval phrase=case( searchmatch("Sign-up experience experiment not allowed"), "Sign-up experience experiment not allowed", searchmatch("Sign-up experience experiment allowed"), "Sign-up experience experiment allowed", searchmatch("experiments.1"), "experiments.1" ) | stats count by phrase

Regards,
Prewin
🌟If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: use strings values as a variable to do stats

gsbpp — Thu, 30 Oct 2025 14:51:44 GMT

It worked. Thank you!