Does this do what you want?
| makeresults
| eval _raw="295 <14>1 2021-06-02T02:41:30.349362+00:00 Member-Service-Support.pro.ichiba-chat-server-v2482 5fcb6c91-6e9b-489a-8f55-6f60cbaa8175 [APP/PROC/WEB/1] - - message={\"err\":null,\"count\":1},service=\"ichiba\",sessionId=\"95b480ec-bdcf-4b08-9af3-cfbfb8386a1d\",processId=\"77e0d3ac-4d4c-4cca-9025-173c49660293\""
| eval len=len(_raw)
| rex field=_raw "Member-Service-Support.pro.ichiba-chat-server-v\d+\s(?<guid>(\w+-?){5})"
| stats sum(len) as total_len by guid
the rex statement extracts the guid based on the regex, with the guid assumed to be found after the regex
Member-Service-Support.pro.ichiba-chat-server-v\d+\s
hopefully this gives you what you want?
Does this do what you want?
| makeresults
| eval _raw="295 <14>1 2021-06-02T02:41:30.349362+00:00 Member-Service-Support.pro.ichiba-chat-server-v2482 5fcb6c91-6e9b-489a-8f55-6f60cbaa8175 [APP/PROC/WEB/1] - - message={\"err\":null,\"count\":1},service=\"ichiba\",sessionId=\"95b480ec-bdcf-4b08-9af3-cfbfb8386a1d\",processId=\"77e0d3ac-4d4c-4cca-9025-173c49660293\""
| eval len=len(_raw)
| rex field=_raw "Member-Service-Support.pro.ichiba-chat-server-v\d+\s(?<guid>(\w+-?){5})"
| stats sum(len) as total_len by guid
the rex statement extracts the guid based on the regex, with the guid assumed to be found after the regex
Member-Service-Support.pro.ichiba-chat-server-v\d+\s
hopefully this gives you what you want?