Splunk Search

Display count of two field in a same dashboard

Loves-to-Learn Lots

I have two fields in two different log lines and want result something like below sample table :-

product_code_pausecountproduct_code_unpausecount
1234567312345672

 

How can I achieve this by updating below query :-

("Pause entry") OR ("Paused Entry added back to cart successfully : ") | rex field=_raw "product : (?<product_code_pause>(?:[^,]+))" | rex field=_raw "successfully : (?<product_code_unpause>(?:[^,]+))" | stats count by product_code_pause,product_code_unpause

Labels (5)
Tags (3)
0 Karma