Create Counter Field

[sanjay_shrestha]

Hi,

Here is log file:

2013-06-14-15_18_42.618 [6624] INFO Read barcode in Cart2 rack 1: NOREAD

2013-06-14-15_18_42.618 [1123] DEBUG debug info.....

2013-06-14-15_18_42.619 [6624] INFO Read barcode in Cart2 rack 1: E1

2013-06-14-15_18_42.619 [1123] DEBUG debug info.....

2013-06-14-15_18_42.620 [6624] INFO Read barcode in Cart2 rack 1: E13

2013-06-14-15_18_42.620 [6624] INFO Read barcode in Cart2 rack 1: E13A

2013-06-14-15_18_43.619 [1123] DEBUG debug info.....

2013-06-14-15_18_43.629 [1123] DEBUG debug info.....

2013-06-14-15_18_43.639 [1123] DEBUG debug info.....

2013-06-14-15_18_44.621 [6624] INFO Read barcode in Cart2 rack 1: EAM

2013-06-14-15_18_44.621 [6624] INFO Read barcode in Cart2 rack 1: EM

2013-06-14-15_18_44.621 [6624] INFO Read barcode in Cart2 rack 1: E2340007

2013-06-14-15_18_44.622 [6624] INFO Read barcode in Cart2 rack 1: E1308

...

..

2013-06-15-15_18_42.618 [6624] INFO Read barcode in Cart2 rack 2: NOREAD

2013-06-15-15_18_42.618 [1123] DEBUG debug info.....

2013-06-15-15_18_42.619 [6624] INFO Read barcode in Cart2 rack 2: A1

2013-06-15-15_18_42.619 [1123] DEBUG debug info.....

2013-06-15-15_18_42.620 [6624] INFO Read barcode in Cart2 rack 2: AE13

2013-06-15-15_18_42.620 [6624] INFO Read barcode in Cart2 rack 2: EQ13A

2013-06-15-15_18_43.619 [1123] DEBUG debug info.....

2013-06-15-15_18_43.629 [1123] DEBUG debug info.....

2013-06-15-15_18_43.639 [1123] DEBUG debug info.....

2013-06-15-15_18_44.621 [6624] INFO Read barcode in Cart2 rack 2: E1AM

2013-06-15-15_18_44.621 [6624] INFO Read barcode in Cart2 rack 2: EPPM

2013-06-15-15_18_44.621 [6624] INFO Read barcode in Cart2 rack 2: E232340007

2013-06-15-15_18_44.622 [6624] INFO Read barcode in Cart2 rack 2: SSE1308

...

..

2013-06-16-15_18_42.618 [6624] INFO Read barcode in Cart1 rack 1: NOREAD

2013-06-16-15_18_42.618 [1123] DEBUG debug info.....

2013-06-16-15_18_42.619 [6624] INFO Read barcode in Cart1 rack 1: POE1

2013-06-16-15_18_42.619 [1123] DEBUG debug info.....

2013-06-16-15_18_42.620 [6624] INFO Read barcode in Cart1 rack 1: OUE13

2013-06-16-15_18_42.620 [6624] INFO Read barcode in Cart1 rack 1: EMM13A

2013-06-16-15_18_43.619 [1123] DEBUG debug info.....

2013-06-16-15_18_43.629 [1123] DEBUG debug info.....

2013-06-16-15_18_43.639 [1123] DEBUG debug info.....

2013-06-16-15_18_44.621 [6624] INFO Read barcode in Cart1 rack 1: E45A4M

2013-06-16-15_18_44.621 [6624] INFO Read barcode in Cart1 rack 1: E89MWW

2013-06-16-15_18_44.621 [6624] INFO Read barcode in Cart1 rack 1: E2347

2013-06-16-15_18_44.622 [6624] INFO Read barcode in Cart1 rack 1: E130AWA

I need to create calculated counter field which should reset after each Cart Rack block. In this example, needed result would be as follows:

_raw----------------------------->-CounterID

....Cart2 rack 1: NOREAD------>1

....Cart2 rack 1: E1------------>2

....

....Cart2 rack 1: E1308------>8

....

....

....Cart2 rack 2: NOREAD------>1

....Cart2 rack 2: A1------>2

....

....Cart2 rack 2: SSE1308------>8

....

....Cart1 rack 1: NOREAD------>1

....Cart1 rack 1: POE1------>2

....

....Cart1 rack 1: E130AWA------>8

....

(There would be 8 entries for each Cart Rack combination)

Thanks,

Sanjay

[chris · Accepted solution]

If the cart & rack combination are unique and the log is chronological then this could work:

 basesearch | rex "Cart(?<cart>\d)\srack\s(?<rack>\d)" | streamstats count by cart,rack

onyl search for events containing INFO in your basesearch

[sanjay_shrestha]

Thanks Chris. It worked !!!