Generate table from search result using wildcard

[asitagr]

spath "log.message" | search "log.message"="REQ_TRACK_ID_MISSING*" OR "log.message" ="DESERIALIZATION_EXCEPTION*" OR "log.message" = "SERIALIZATION_EXCEPTION*".

Then from the results, I want to trim the asterisk part of string and print a table with count eg.

log.message	count
REQ_TRACK_ID_MISSING	10
DESERIALIZATION_EXCEPTION	12
SERIALIZATION_EXCEPTION	5

I tried so many functions including replace, trim.. but I'm not able to formulate the results as shown above.  How can we achieve this?

[richgalloway]

I usually do that using a case expression.

spath "log.message" 
| search "log.message"="REQ_TRACK_ID_MISSING*" OR "log.message" ="DESERIALIZATION_EXCEPTION*" OR "log.message" = "SERIALIZATION_EXCEPTION*"
| eval logMessage = case(match("log.message","REQ_TRACK_ID_MISSING.*"),  "REQ_TRACK_ID_MISSING", match("log.message", "DESERIALIZATION_EXCEPTION.*"), "DESERIALIZATION_EXCEPTION", match("log.message", "SERIALIZATION_EXCEPTION.*"), "SERIALIZATION_EXCEPTION", 1=1, "log.message")