Regex Stats count Help

[valpravin]

Hi All

I have String result as a

"Event":"BirthDay"
"Event":"MarriageAnniversary"
"Event":"NewYear"
"Event":"BirthDay"

when I do stats count by activity I want to get results as:

BirthDay : 2
MarriageAnniversary : 1
NewYear : 1

Tried Like this but no help

| rex field=_raw "\?Event=(?"":"\w+")" | stats count by Event

[richgalloway]

When writing regular expressions or other code in questions, answers, or comments it's best to enclose them in backtic characters (`) so they don't get dropped. You can also highlight your code and click the "101010" button.

[richgalloway]

Your regex string is a little off. Try this one. You may need to insert additional backslashes to make rex happy. It can be tricky to create a regex with quotes in it.

| rex "Event\":\"(?<Event>\w+)\"" | ...

[tiagofbmm · Accepted solution]

Hello

Please try this one

| rex field=_raw "\"Event\"\:\"(?<Activity>[^\"]*)"