How do I merge these two regular expressions? (which are identical but one for filtering events, the other for extracting fields)
I am | regex _raw = "I am (?<Name>.*)" | rex "I am (?<Name>.*)" | stats count Count by Name
I already tried
I am | setfields Name = 0 | rex "I am (?<Name>.*)" | where Name != 0 | stats count Count by Name
Somehow it didn't work, until I changed where Name != 0 to where not Name = 0.
where Name != 0
where not Name = 0
From what I learnt in other answers, the behavior of Name != 0 and not Name = 0 would differ when Name doesn't exist, but in this case Name should always exist after setfields Name = 0.
Name != 0
not Name = 0
setfields Name = 0
Did I miss something?
What are you trying to do?
Bottom line is you don't do both in same regex. It looks like you are trying to only count by Name when there is a value for Name. Try this...
I am | regex _raw = "I am (?<Name>.*)" | stats count AS Count by Name
Stats will only count the when there is a value for Name.
Should get same results with this where the search Name=* requires Name.
I am | regex _raw = "I am (?<Name>.*)" | search Name=* | stats count AS Count by Name