Hi Everyone,
I have one requirement. I am showing my RID with their source and their counts as of now its coming like this:
My search query:
index=ABCns=XYZ app_name=DF "ARC EVENT RECEIVED FROM SOURCE"| rex "RID:(?<RID>(\w+-){4}\w+)-(?<sourceagent>\w+-\w+)"
| stats count(RID) as count, values(RID) as RID by sourceagent| rename sourceagent as "Source"|fields Source count
what I want now is like for Source of1-team_b the count is 5 and all the RID's are coming in one block.
RID Source count
8730e34b-d619-40c9-9f1b-6b39f534daea | of1-team_a | 1 |
07cefd49-ec3f-44b4-b313-24eb486dda02 5b23febe-1817-405d-8e7f-c4388feb9fbc 9cc7154e-11a2-43e1-a970-590d359fbadd c09b64eb-45c3-4fcb-9deb-81faa3d5c98b f56bce02-750d-451c-a341-4769d7518f2c | of1-team_b | 5 |
Now I want to show only and the count so I want each RID should come separately like this:
RID Source count
8730e34b-d619-40c9-9f1b-6b39f534daea | of1-team_a | 1 |
07cefd49-ec3f-44b4-b313-24eb486dda02 | of1-team_b | 1 |
5b23febe-1817-405d-8e7f-c4388feb9fbc | of1-team_b | 1 |
Means each RID should be separately .
Can someone guide me on this.
Surely, this is just a table of sourceagent and Rid
index=ABCns=XYZ app_name=DF "ARC EVENT RECEIVED FROM SOURCE"| rex "RID:(?<RID>(\w+-){4}\w+)-(?<sourceagent>\w+-\w+)"
| eval count=1
| table RID, sourceagent, count | rename sourceagent as "Source"
Surely, this is just a table of sourceagent and Rid
index=ABCns=XYZ app_name=DF "ARC EVENT RECEIVED FROM SOURCE"| rex "RID:(?<RID>(\w+-){4}\w+)-(?<sourceagent>\w+-\w+)"
| eval count=1
| table RID, sourceagent, count | rename sourceagent as "Source"
index=ABCns=XYZ app_name=DF "ARC EVENT RECEIVED FROM SOURCE"| rex "RID:(?<RID>(\w+-){4}\w+)-(?<sourceagent>\w+-\w+)"
| stats count, by sourceagent,RID
| rename sourceagent as "Source"