Count identical messages as a total value in the results

[seanmylne]

Hi guys,

What i would like to do is display as a count the number of times an identical message is seen in the Message.EventMessage field. If there was only one hit in the logs display 1.

So far my code only shows count = 1 even tough i have multiple identical messages 😞

I would also like to display when the message was last seen in the logs too, but this does not seam to work so have given up on that for now, unless anyone knows how this can be done using what I have pasted below?

Message.EventMessage="* has been flagged *" | stats Count list(Message.EventMessage) AS Name by _time Message.EventMessage | eval "First Seen"=_time | convert timeformat="%H:%M:%S:%3N %d/%m/%Y" ctime("First Seen") | dedup Message.EventMessage| table "First Seen", Name, Count

Thanks
Sean

[pradeepkumarg]

Message.EventMessage=" has been flagged " | stats count first(_time) last(_time) by Message.EventMessage | rename Message.EventMessage as Name