Hi, any help with this would be appreciated!
rex field=msg.message "loc=(?<place>\d+)" | search place="16" | stats count by "place"
The extracted field is place. The specific place I am searching for is "16". Is there a more efficient way to search for a specific place before calling stats?
I'm not sure if it's "more efficient", but you could try this search. Compare this your other one using Job Inspector to see which works best.
| where match(msg.message, "loc=16")| stats count