topic Search Query to display the RID separately in Dashboards & Visualizations

Search Query to display the RID separately

aditsss — Mon, 05 Oct 2020 08:41:56 GMT

Hi Everyone,

I have one requirement. I am showing my RID with their source and their counts as of now its coming like this:

My search query:

index=ABCns=XYZ app_name=DF "ARC EVENT RECEIVED FROM SOURCE"| rex "RID:(?<RID>(\w+-){4}\w+)-(?<sourceagent>\w+-\w+)"
| stats count(RID) as count, values(RID) as RID by sourceagent| rename sourceagent as "Source"|fields Source count

what I want now is like for Source of1-team_b the count is 5 and all the RID's are coming in one block.

RID Source count

8730e34b-d619-40c9-9f1b-6b39f534daea	of1-team_a	1
07cefd49-ec3f-44b4-b313-24eb486dda02 5b23febe-1817-405d-8e7f-c4388feb9fbc 9cc7154e-11a2-43e1-a970-590d359fbadd c09b64eb-45c3-4fcb-9deb-81faa3d5c98b f56bce02-750d-451c-a341-4769d7518f2c	of1-team_b	5

Now I want to show only and the count so I want each RID should come separately like this:

RID Source count

8730e34b-d619-40c9-9f1b-6b39f534daea	of1-team_a	1
07cefd49-ec3f-44b4-b313-24eb486dda02	of1-team_b	1

5b23febe-1817-405d-8e7f-c4388feb9fbc

of1-team_b

Means each RID should be separately .

Can someone guide me on this.

Re: Search Query to display the RID separately

thambisetty — Mon, 05 Oct 2020 08:49:16 GMT

index=ABCns=XYZ app_name=DF "ARC EVENT RECEIVED FROM SOURCE"| rex "RID:(?<RID>(\w+-){4}\w+)-(?<sourceagent>\w+-\w+)" | stats count, by sourceagent,RID | rename sourceagent as "Source"

Re: Search Query to display the RID separately

ITWhisperer — Mon, 05 Oct 2020 09:29:36 GMT

Surely, this is just a table of sourceagent and Rid

index=ABCns=XYZ app_name=DF "ARC EVENT RECEIVED FROM SOURCE"| rex "RID:(?<RID>(\w+-){4}\w+)-(?<sourceagent>\w+-\w+)" | eval count=1 | table RID, sourceagent, count | rename sourceagent as "Source"