I am trying to create a table which shows 3 column error msg, errorcode, and count. my current query is pulling the errorcode/msg in one column and error count individually instead of whole. Please assist.
my Current Query
My current query
Current Output
Expected Output
@Khanu89 - It's actually an issue with regex (rex) extracting ErrorCode, that it is extracting ErrorCode and error message everything in a single field.
You can try extracting them separately and then you can update your stats to add the error_msg field in the groupby (or by).
I hope this helps!!!
| rex field=_raw "%\s(?<ErrorCode>\d+)\s(?<error_msg>.*)\s"
And then you can use
| stats ..... by ErrorCode, error_msg
something like this. Regex could not be valid for all the use cases, I'm just seeing a few examples from the screenshot.