I am trying to find few strings in my search query and count occurrences of them and I want to put them in a two column table. I am able to do it with stat command, but it's coming like string as column name and count in the row bwlow. Below is what I am using and what I ma getting.
index=<index> <search String > "Failed" | stats count AS Failed count(eval(searchmatch("Failed Acknowledged"))) AS "Failed Acknowledged" count(eval(searchmatch("UnexpectedException Caught"))) AS "UnexpectedException Caught" count(eval(searchmatch("NonRetryableException Caught"))) AS "NonRetryableException Caught"
However I want a result like below.
Can anyone help? Thanks in advance.
Is this accomplishing what you are looking for? (I assume you are working with untransformed Events here)
index=<index> <search String > "Failed" | eval Message = case(like(_raw,"%Failed Acknowledged%"),"Failed Acknowledged",like(_raw,"%UnexpectedException Caught%"),"UnexpectedException Caught",like(_raw,"%NonRetryableException Caught%"),"NonRetryableException Caught",true(),NULL) | stats count by Message
If you want to add a line that sums up the total amount of events you can add the following:
| addtotals fieldname=count col=t labelfield=Message