Count based on extracted field

[athorat]

Hi

I have an event which has something like
/getproxy..... size:1
/getproxy..... size:10
/getproxy..... size:0

Want to calculate the total count when the size!=0 and count when size=0
using a rex in the search to extract size value

| rex "size:(?<Size>\d+)"

Any help appreciated

[fdi01 · Accepted solution]

try like :

 ...| rex "size:(?<Size>\d+)"|stats sum(eval(Size!=0)) as "total size!=0" sum(eval(Size=0)) as "total size=0"|...

or
for the number of time size!=0 and number of time size=0 try this:

 ...| rex "size:(?<Size>\d+)"|stats count(eval(Size!=0)) as "number of time size!=0" count(eval(Size=0)) as "number of time size=0"|...

[sideview]

Of if you're more comfortable leaving eval tasks to the eval command, more or less the same idea would look like:
...| rex "size:(?\d+)"|eval type=if(Size=0,"zero","nonzero") | stats count by type