Search Query to display the RID separately

[aditsss]

Hi Everyone,

I have one requirement. I am showing my RID with their source and their counts as of now its coming like this:

My search query:

index=ABCns=XYZ app_name=DF "ARC EVENT RECEIVED FROM SOURCE"| rex "RID:(?<RID>(\w+-){4}\w+)-(?<sourceagent>\w+-\w+)"
| stats count(RID) as count, values(RID) as RID by sourceagent| rename sourceagent as "Source"|fields  Source count

what I want now is like for Source of1-team_b the count is 5 and all the RID's are coming in one block.

RID Source count

8730e34b-d619-40c9-9f1b-6b39f534daea	of1-team_a	1
07cefd49-ec3f-44b4-b313-24eb486dda02 5b23febe-1817-405d-8e7f-c4388feb9fbc 9cc7154e-11a2-43e1-a970-590d359fbadd c09b64eb-45c3-4fcb-9deb-81faa3d5c98b f56bce02-750d-451c-a341-4769d7518f2c	of1-team_b	5

Now I want to show only and the count so I want each RID should come separately like this:

RID Source count

8730e34b-d619-40c9-9f1b-6b39f534daea	of1-team_a	1
07cefd49-ec3f-44b4-b313-24eb486dda02	of1-team_b	1

5b23febe-1817-405d-8e7f-c4388feb9fbc

of1-team_b

1

Means each RID should be separately .

Can someone guide me on this.

[ITWhisperer · Accepted solution]

Surely, this is just a table of sourceagent and Rid

index=ABCns=XYZ app_name=DF "ARC EVENT RECEIVED FROM SOURCE"| rex "RID:(?<RID>(\w+-){4}\w+)-(?<sourceagent>\w+-\w+)"
| eval count=1
| table RID, sourceagent, count | rename sourceagent as "Source"

[thambisetty]

index=ABCns=XYZ app_name=DF "ARC EVENT RECEIVED FROM SOURCE"| rex "RID:(?<RID>(\w+-){4}\w+)-(?<sourceagent>\w+-\w+)"
| stats count,  by sourceagent,RID
| rename sourceagent as "Source"