Some cost calculation by counting the number of characters per line and grouping

[anil1432]

We want to work on some cost calculation by counting the number of characters per line and grouping the size per custom fields found in the line.

For example: this is 1 line

295 <14>1 2021-06-02T02:41:30.349362+00:00 Member-Service-Support.pro.ichiba-chat-server-v2482 5fcb6c91-6e9b-489a-8f55-6f60cbaa8175 [APP/PROC/WEB/1] - - message={"err":null,"count":1},service="ichiba",sessionId="95b480ec-bdcf-4b08-9af3-cfbfb8386a1d",processId="77e0d3ac-4d4c-4cca-9025-173c49660293"


1) Count the number of characters for this line

2) Set the count under non-field value GUID for this line is "5fcb6c91-6e9b-489a-8f55-6f60cbaa8175"

3) Get the total count per GUID

​I hope you can help us. Let me know if you need

[bowesmana · Accepted solution]

Does this do what you want?

| makeresults
| eval _raw="295 <14>1 2021-06-02T02:41:30.349362+00:00 Member-Service-Support.pro.ichiba-chat-server-v2482 5fcb6c91-6e9b-489a-8f55-6f60cbaa8175 [APP/PROC/WEB/1] - - message={\"err\":null,\"count\":1},service=\"ichiba\",sessionId=\"95b480ec-bdcf-4b08-9af3-cfbfb8386a1d\",processId=\"77e0d3ac-4d4c-4cca-9025-173c49660293\""
| eval len=len(_raw)
| rex field=_raw "Member-Service-Support.pro.ichiba-chat-server-v\d+\s(?<guid>(\w+-?){5})"
| stats sum(len) as total_len by guid

the rex statement extracts the guid based on the regex, with the guid assumed to be found after the regex 

Member-Service-Support.pro.ichiba-chat-server-v\d+\s

hopefully this gives you what you want?

[anil1432]

@bowesmana 

Thank you very much it's very helpful 😊😊🤘