I have the following search :
index="efept" source=/var/log/efe/server.log host=efeprodapp13 FilingTypeId: AND Routing AND ApplicationId:
I like to get the count by applicationId/FilingTypeId pair, in other words I like to have the count for each applicationId and FilingTypeId.
Here is my sample data:
10:44:16.586 AM 2011-07-14 10:44:16,586 INFO [:ajp-0.0.0.0-8009-13] - Routing Message FROM
For example :
index="efept" source=/var/log/efe/server.log host=efeprodapp13 FilingTypeId: AND Routing AND ApplicationId: |Stats dc("some field you want so summarize) By ApplicationID
Regards