Discrepancy while using count by with multiple fields (extracted fields)

[Lihtnes007]

I'm trying to extract the data from logs and display the count  based on 2 fields.

Below are the sample data logs,

14:48:23.668 INFO - Response(Uuid=1e850916-f99d-1e35a8d3c474, pojo=[Pojo(id=ID0047, flg=false), Pojo(id=ID0065, flg=false), Pojo(id=ID0105, flg=true), Pojo(id=ID0106, flg=true), Pojo(id=ID0066, flg=false), Pojo(id=ID0108, flg=false)])
14:48:23.676 INFO - Response(Uuid=c5ec43a2-8c07-c56f9f5bbd1f, pojo=[Pojo(id=ID0106, flg=false), Pojo(id=ID0107, flg=false), Pojo(id=ID0068, flg=true), Pojo(id=ID0105, flg=false), Pojo(id=ID0064, flg=true), Pojo(id=ID0108, flg=false), Pojo(id=ID0047, flg=false)])
14:48:23.690 INFO - Response(Uuid=eac5f53e-6407-eac356ca0458, pojo=[Pojo(id=ID0107, flg=false), Pojo(id=ID0047, flg=true), Pojo(id=ID0067, flg=false), Pojo(id=ID0106, flg=false), Pojo(id=ID0068, flg=false), Pojo(id=ID0108, flg=false)])

Below is the current query ,

<base query | rex field=pojo max_match=0 "Pojo\((?<ID>.*?)\,(?<FLG>.*?)\)" | chart count by ID FLG>

If i'm using one field in count by its giving the correct count ( ID / FLG ) but when i'm use both its not giving correct count as in query.

Sample expected output looks like below,

ID   FLG=false   FLG=true

ID0047   2   1

ID0107   2   0

ID0065   1   0

..

Kindly help or suggest me.

[Lihtnes007]

It Works !

[ITWhisperer · Accepted solution]

Your rex will give you two parallel multivalue fields which end up being cross matched multiplying the number of events you appear to have. Try separating them as pairs first

| makeresults
| eval _raw="14:48:23.668 INFO - Response(Uuid=1e850916-f99d-1e35a8d3c474, pojo=[Pojo(id=ID0047, flg=false), Pojo(id=ID0065, flg=false), Pojo(id=ID0105, flg=true), Pojo(id=ID0106, flg=true), Pojo(id=ID0066, flg=false), Pojo(id=ID0108, flg=false)])
14:48:23.676 INFO - Response(Uuid=c5ec43a2-8c07-c56f9f5bbd1f, pojo=[Pojo(id=ID0106, flg=false), Pojo(id=ID0107, flg=false), Pojo(id=ID0068, flg=true), Pojo(id=ID0105, flg=false), Pojo(id=ID0064, flg=true), Pojo(id=ID0108, flg=false), Pojo(id=ID0047, flg=false)])
14:48:23.690 INFO - Response(Uuid=eac5f53e-6407-eac356ca0458, pojo=[Pojo(id=ID0107, flg=false), Pojo(id=ID0047, flg=true), Pojo(id=ID0067, flg=false), Pojo(id=ID0106, flg=false), Pojo(id=ID0068, flg=false), Pojo(id=ID0108, flg=false)])"
| multikv noheader=t 
| table _raw



| rex max_match=0 "Pojo\((?<IDFLG>.*?)\)"
| chart count by IDFLG
| eval IDFLG=split(IDFLG,",")
| eval ID=mvindex(IDFLG,0), FLG=mvindex(IDFLG,1)
| xyseries ID FLG count
| fillnull value=0