How do I group events from three rules by the same field value

[DEAD_BEEF]

I have a tool that generates three different alerts (alert1, alert 2, alert3). In these alerts, it records the username (parsed out via rex). I am having trouble correlating events when all three alerts contain the same username within a 7 day period. Ideally, I would like to create a dashboard that shows me how many times a username has been observed in alert1, alert2, and alert3 (not in each alert, but in all 3).

Which commands should I be looking at to show me when the username in alert1 = alert2 = alert3 ?

Current search query
index=tool rule=alert* | rex field=Message "(?<USERNAME>(?<=;)[^;]*(?=;))" | unknown_query

[somesoni2 · Accepted solution]

Give this a try

index=tool rule=alert* | rex field=Message "(?<USERNAME>(?<=;)[^;]*(?=;))" | chart count over USERNAME by rule | where alert1>0 AND alert2>0 AND alert3>0

[DEAD_BEEF]

I have been pouring over another post that you answered regarding streamstats trying to decipher it all out but this is perfect! Exactly what I was looking for. Thank you so much!!

[asimagu]

streamstats dc(rule) as count by USERNAME | where count>2

will give you the events where the user is seen in the 3 alerts, then you could pipe into the stats command if you want to do further computing

[DEAD_BEEF]

user3 shows 1 hit, I looked through the logs and only find user3 in alert3 (no hits for alert1 and alert2). I don't think it's working. Can you take a look?

index=tool rule=alert* | rex field=Message "(?(?<=;)[^;]*(?=;))" | streamstats dc(rule) as count by USERNAME | where count>2 | stats count by USERNAME

output:
user1     15
user2     3
user3     1