Counting occurences of 5 specific strings in logs

[AshimaE]

For a given sourcetype=src I have to search for five specific strings (let it be "abc", "def", "ghi", "jkl", "mno") occuring in the log and give the counts of each of these strings for every 10 minutes.

I had thought of doing it using join after calculating counts for each separately. Is there any better way of doing it since the sourcetype is the same.
For each individual 1 I had planned to use the query
index=cm sourcetype=src "abc"| timechart span=10m count |join _time [....]

[niketn · Accepted solution]

@AshimaE, If the strings are not already extracted as fields you can use searchmatch eval function to count the same.

index=cm sourcetype=src ("abc"  OR "def" OR "ghi" OR "jkl" OR "mno")
| timechart span=10m count(eval(searchmatch("abc"))) as "abc" count(eval(searchmatch("def"))) as "def" count(eval(searchmatch("ghi"))) as "ghi" count(eval(searchmatch("jkl"))) as "jkl" count(eval(searchmatch("mno"))) as "mno"

Since you are currently doing/planning this with join I am expecting events are not overlapping, i.e. event with "abc" will not have "def" and so on. If it does there will be different approach required. Please try out and confirm.

[AshimaE]

Yes they do not overlap so this approach works good with my purpose. Thanks a lot @niketnilay

[niketn]

Glad it worked!!! 🙂

[adonio]

up-voting, i learned something new today!
thanks @niketnilay

[niketn]

@adonio, we all learn from each other. Your immaculate answers are always worth reading and most of the time I go BINGO, that is how it is done 🙂 Thanks!