How can I get stats by author if I have multiline events like the below?
Project: /a/b/c
loc=100 author=aaa@foo.com
loc=100 author=bbb@foo.com
loc=100 author=ccc@foo.com
Project: /a/b/c
loc=200 author=aaa@foo.com
loc=200 author=ccc@foo.com
loc=200 author=ddd@foo.com
Given the 2 events above, am looking for a results table like this:
Project Author Total Lines of Code (loc)
-------------------------------------------------
/a/b/c aaa@foo.com 300
bbb@foo.com 100
ccc@foo.com 300
ddd@foo.com 200
You could do something like this:
... | rex "Project:\s+(?<project>\S+)" | rex max_match=0 "(?<loc_author>loc=\d+\s+author=\S+)" | mvexpand loc_author | rex field=loc_author "loc=(?<loc>\d+)\s+author=(?<author>\S+)" | stats sum(loc) by project author
Make sure that doesn't clash with a potentially auto-extracted first set of loc/author fields.
You could do something like this:
... | rex "Project:\s+(?<project>\S+)" | rex max_match=0 "(?<loc_author>loc=\d+\s+author=\S+)" | mvexpand loc_author | rex field=loc_author "loc=(?<loc>\d+)\s+author=(?<author>\S+)" | stats sum(loc) by project author
Make sure that doesn't clash with a potentially auto-extracted first set of loc/author fields.
Thank you, Martin! mvexpand is magical. 🙂