I have the following data :
Service | Message |
Service1 | Hello world |
Service2 | Another message |
Service1 | Hello world |
Service1 | Some other message |
How can I write a report such that the final output looks like :
Service
Message : count
For example, with the data above, it should be :
Service1
Hello world : 2
Some other message : 1
Service 2
Another message : 1
Try this search:
<your current search>
| stats count by Service, Message
If you want a different format:
<your current search>
| stats count by Service, Message
| eval Message = Message." (".count.")"
| stats list(Message) by Service
I hope this helps!!!
Can you please try this?
YOUR_SEARCH
| stats count by Service Message
| eval dummy=Message.":".count
| stats list(dummy) As dummy by Service
| eval value=mvappend(Service,dummy," ")
| mvexpand value
| table value
My Sample Search :
| makeresults
| eval _raw="Service Message
Service1 Hello world
Service2 Another message
Service1 Hello world
Service1 Some other message"
| multikv forceheader=1
| table Service Message
| rename comment as "Upto now is for sample data only"
| stats count by Service Message
| eval dummy=Message.":".count
| stats list(dummy) As dummy by Service
| eval value=mvappend(Service,dummy," ")
| mvexpand value
| table value
Thanks
KV
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
Try this search:
<your current search>
| stats count by Service, Message
If you want a different format:
<your current search>
| stats count by Service, Message
| eval Message = Message." (".count.")"
| stats list(Message) by Service
I hope this helps!!!