Count occurrences of string and put them in table row wise?

[Vivekmishra01]

I am trying to find few strings in my search query and count occurrences of them and I want to put them in a two column table. I am able to do it with stat command, but it's coming like string as column name and count in the row bwlow. Below is what I am using and what I ma getting.

index=<index> <search String > "Failed" | stats count AS Failed count(eval(searchmatch("Failed Acknowledged"))) AS "Failed Acknowledged" count(eval(searchmatch("UnexpectedException Caught"))) AS "UnexpectedException Caught" count(eval(searchmatch("NonRetryableException Caught"))) AS "NonRetryableException Caught"

However I want a result like below.

Can anyone help? Thanks in advance.

[FelixLeh]

Hi!
Is this accomplishing what you are looking for? (I assume you are working with untransformed Events here)

index=<index> <search String > "Failed" 
| eval Message = case(like(_raw,"%Failed Acknowledged%"),"Failed Acknowledged",like(_raw,"%UnexpectedException Caught%"),"UnexpectedException Caught",like(_raw,"%NonRetryableException Caught%"),"NonRetryableException Caught",true(),NULL)
| stats count by Message 

 If you want to add a line that sums up the total amount of events you can add the following:

| addtotals fieldname=count col=t labelfield=Message

[GaetanVP · Accepted solution]

Hello ! 

You could try this :

<your search> | transpose 0 column_name="Message" | rename "row 1" as Count

Good luck!