use strings values as a variable to do stats

[gsbpp]

index=myindex  ( "Sign-up experience experiment not allowed" OR "Sign-up experience experiment allowed" OR "experiments.1" )

SO, there are three string searches; the first tow differ in a "not" inside the text.

I would like to do a stats to count for the appearance of each, e.g.

| stats count by  <var>

[PrewinThomas · Accepted solution]

@gsbpp 
You can try something below to match and do a stats count.

index=myindex (
"Sign-up experience experiment not allowed"
OR "Sign-up experience experiment allowed"
OR "experiments.1"
)
| eval phrase=case(
searchmatch("Sign-up experience experiment not allowed"), "Sign-up experience experiment not allowed",
searchmatch("Sign-up experience experiment allowed"), "Sign-up experience experiment allowed",
searchmatch("experiments.1"), "experiments.1"
)
| stats count by phrase

Regards,
Prewin
🌟If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[gsbpp]

It worked. Thank you!

[richgalloway]

If the searched-for strings are in a known field then you can use that field in the stats command.

index=myindex ( "Sign-up experience experiment not allowed" OR "Sign-up experience experiment allowed" OR "experiments.1" )
| stats count by foo

OTOH, if the strings can be anywhere then it gets more involved.  We need to create a field for the stats command to use.

index=myindex ( "Sign-up experience experiment not allowed" OR "Sign-up experience experiment allowed" OR "experiments.1" )
| eval foo=case(searchmatch("Sign-up experience experiment not allowed"),"Not allowed", 
searchmatch("Sign-up experience experiment allowed"), "Allowed", searchmatch("experiments.1"), "Experiments",
1==1, "Other" )
| stats count by foo