Combine rex field

[DougiieDee]

how do i combine both these rex field into one and display the count?

index=abc
"exception":"CommonApplicationException"
| rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)"
| stats count by ABC_CODE, Message

index=abc
ABC-*
|rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_Code>ABC\-\d+)\"\,\"message\"\:\"(?P<Message>[^\"]+)" | where ABC_Code!="" | search ABC_Code=* | Stats count by ABC_Code, Message

[kamlesh_vaghela]

@DougiieDee 

Can you please try this?

index=abc ("exception":"CommonApplicationException" OR ABC-*)
| rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE_1>[^\:]+)\:(?<Message_1>[^\"]+)"
|rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_CODE_2>ABC\-\d+)\"\,\"message\"\:\"(?P<Message_2>[^\"]+)" 
| eval ABC_CODE=if(isnotnull(ABC_CODE_1),ABC_CODE_1,ABC_CODE_2)
| eval Message=if(isnotnull(Message),Message_1,Message_2)
| where ABC_CODE!=""
| stats count by ABC_CODE, Message

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[DougiieDee]

The results are only showing from this 

|rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_CODE_2>ABC\-\d+)\"\,\"message\"\:\"(?P<Message_2>[^\"]+)" 

other rex field didnt show the results.

[kamlesh_vaghela]

@DougiieDee 

Can you please expand timerange if possible?

Meanwhile can you please share sample events from both search?

[DougiieDee]

1. {\"errors\":[{\"code\"\"ABC-1000\",\"message\"\"Sorry we are unable to process your request.

index=abc  ABC-*
|rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_Code>ABC\-\d+)\"\,\"message\"\:\"(?P<Message>[^\"]+)" | where ABC_Code!="" | search ABC_Code=* | Stats count by ABC_Code Message

2. exception:CommonApplicationException ABC_1001:We're sorry, it looks like an error occured

index=abc "exception":"CommonApplicationException"
| rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)"
| eval Message=substr(Message, 1, 140)
| stats count by ABC_CODE, Message

I have these two rex and want to combine both but because these two are different is it possible to combine them and have Stats count by ABC_Code Message?