Hi, any help with this would be appreciated!
rex field=msg.message "loc=(?<place>\d+)" | search place="16" | stats count by "place"
The extracted field is place. The specific place I am searching for is "16". Is there a more efficient way to search for a specific place before calling stats?
@richgalloway Is there any more efficient way to do this such as bypassing the field extraction if I am only looking for a singular specific "place"?
I'm not sure if it's "more efficient", but you could try this search. Compare this your other one using Job Inspector to see which works best.
| where match(msg.message, "loc=16")| stats count