Count unique values from a text result

[aionius]

I have the following result from a simple query:

184.168.152.54 10.10.42.61 - - [09/Oct/2013:09:14:38 -0500] "GET /tgg/api2.php?KeyID=k207238&mode=xml&i=9780486472515 HTTP/1.1" 200 23 "-" "-" 0

How can I get the unique values of KeyID and their count?

[gfuente · Accepted solution]

Hello

Try this:

sourcetype="yoursourcetype" | rex "KeyID=(?<KeyID>\w+)\&" | stats count by KeyID

Regards

[lukejadamec]

Try

yoursearch | stats count by KeyID