Hi All
I have String result as a
"Event":"BirthDay"
"Event":"MarriageAnniversary"
"Event":"NewYear"
"Event":"BirthDay"
when I do stats count by activity I want to get results as:
BirthDay : 2
MarriageAnniversary : 1
NewYear : 1
Tried Like this but no help
| rex field=_raw "\?Event=(?"":"\w+")" | stats count by Event
Hello
Please try this one
| rex field=_raw "\"Event\"\:\"(?<Activity>[^\"]*)"
When writing regular expressions or other code in questions, answers, or comments it's best to enclose them in backtic characters (`) so they don't get dropped. You can also highlight your code and click the "101010" button.
Your regex string is a little off. Try this one. You may need to insert additional backslashes to make rex
happy. It can be tricky to create a regex with quotes in it.
| rex "Event\":\"(?<Event>\w+)\"" | ...
Hello
Please try this one
| rex field=_raw "\"Event\"\:\"(?<Activity>[^\"]*)"