Display specific field in log by count

[Bhavika]

I want to write the query which will number of count the event occurred and time taken for that. 

This is the log  -

log: 2024-07-01 16:57:17.022 INFO 1 --- [nio-8080-exec-6] xyztask : FILE_TRANSFER | Data | LOGS | Fetched count:345243 time:102445ms

time: 2024-07-01T16:57:17.022583728Z

I want result like -

| count           | time |

| 2528945    | 130444 |

Query that I am writing 

base search | stats count by count | stats count by time | table count time

For  stats count by count I am getting error - 

Error in 'stats' command: The output field 'count' cannot have the same name as a group-by field

Query isn't right, correct solution would be helpful. Also tried different queries different ways.

[PickleRick]

With stats command you can use the same field name in both the aggregation function (in your case you want a count of events which yields a field named just count) and the list of fields by which you split the results (in your case count is also a field name within the event.

You can walk around the problem by renaming the field. Like

| stats count as event_count by count

This way the count of events will not be named count in the results but will be named event_count whereas the field by which you split the results (which comes from your events) will stay named count. Yes, it's a tiny bit confusing.

Anyway, I don't see what's the relation between your data and your desired results. And your final table command is completely unnecessary at this point - your results will just contain table of fields count and time after the last stats command so the table command is not needed.

[ITWhisperer]

Is it just a case of extracting count and time from your event? If so, why are you using stats commands?

[Bhavika]

@ITWhisperer  Yes, just the extraction of count and time which is there in log. What is the correct way ? I am new to Splunk.

[ITWhisperer]

Probably the simplest (assuming the event you posted is an accurate representation of your events) is to use rex to extract the fields.

| rex "count:(?<count>\d+) time:(?<time>\d+)ms"

[Bhavika]

This is generating logs and not the expected output.

[ITWhisperer]

What is your full search?

[bowesmana]

rex just extracts the fields, now add

| table count time

if you want each event listed with the count and time.

If you want some other representation of those values, please say what you want