Hi Team,
I would like to know if there is any way to extract/find only the values that is present in more than one event with different values associated.
To explain further on the scenario,below are the logs.
msg: for-service - [2019-03-15T06:01:05.554+0000] "GET /api/for*&byr=**12355**" 404
Please help!!
Thanks in advance!
|rex "vin\=(?P<vin>[^\"]+)\"\s(?P<status>\d+)"
| stats dc(status) as StatusDC, values(status) by vin
| where StatusDC>1
| table vin
I think this should help.
You can see dc(status), values of all the Status by vin by removing, where and table part to test.
Thanks!
Like this:
... | rex "vin\=(?P<vin>[^\"]+)\"\s(?P<status>\d+)"
| stats dc(status) AS status_count values(status) BY vin
| search status_count > 1
Hi @Deepz2612
Try adding this to the end of your search.
|rex "vin\=(?P<vin>[^\"]+)\"\s(?P<status>\d+)"|stats dc(vin) by vin, status
Hi nick,
Thanks!
But my requirement is to list "only" the vins which occurs more than once in logs but with different response code.
Ah, so flip the dc, and use eventstats.
|rex "vin\=(?P<vin>[^\"]+)\"\s(?P<status>\d+)"|eventstats dc(status) by vin as status_count|where status_count>1|table _time vin status
(untested - typed on a phone)