I have a message feild having below data
message=Successfully created customer id XXXX
message =Duplicate create customer id XXXX
message=Error while create customer id XXXX
message=Successfully updated customer id XXXX
message=Error while updating customer id XXXX
can we display it in the below format.
Message Count
Successfully created customer id 1
Duplicate create customer id 1
Error while create customer id 1
Successfully updated customer id 1
Error while updating customer id 1
if not found the count must be 0
| rex field=message "(?<type>(Successfully created|Duplicate create|Error while create|Successfully updated|Error while updating) customer id)"
| stats count by type
| append [| makeresults | eval type="Successfuly created customer id", count=0 | fields type, count ]
| append [| makeresults | eval type="Duplicate create customer id", count=0 | fields type, count ]
| append [| makeresults | eval type="Error while create customer id", count=0 | fields type, count ]
| append [| makeresults | eval type="Successfully updated customer id", count=0 | fields type, count ]
| append [| makeresults | eval type="Error while updating customer id", count=0 | fields type, count ]
| stats sum(count) as count by type