I am trying to extract a corId from the log and find the length of the corId.
when searching am able to successfully locate the Cor Id however when evaluating its lengths, I am not able to succeed.
I used the search query as below
corId | eval length=len(corId)
the actual log file is as below:
ExecuteThread: '10' for queue: 'weblogic.kernel.Default (self-tuning)'> <
Have you extracted the corId field yet with a field extraction?
Once you have the field extracted, eval with the len function is probably the way to go.
From there you can explore doing simple stats around this field...
corId | eval length=len(corId) | stats count by length
corId | eval length=len(corId) | stats max(length) min(length) by User
Or finding searches with especially long ones..
* | eval length=len(corId) | where length>40