Splunk Search

Display count of two field in a same dashboard

Loves-to-Learn Lots

I have two fields in two different log lines and want result something like below sample table :-



How can I achieve this by updating below query :-

("Pause entry") OR ("Paused Entry added back to cart successfully : ") | rex field=_raw "product : (?<product_code_pause>(?:[^,]+))" | rex field=_raw "successfully : (?<product_code_unpause>(?:[^,]+))" | stats count by product_code_pause,product_code_unpause

Labels (5)
Tags (3)
0 Karma