Evalaute field from different areas

[vgodavarty0116]

Hi, I would like to determine a field from different areas of a log. eg see below for my expectations. 

Note: You can be sure these three 

T INFO id=1 sourcetype=userservice FirstName=Vinod

T+1 INFO id=2 sourcetype=loginservice User 'Vinod' logged in

T+2 INFO id=3 sourcetype=userservice FirstName=Jason

T+3 INFO id=4 sourcetype=loginservice User 'Jason' logged in.

T+4 INFO id=5 sourcetype=userservice User deleted: Jason

Output:

Name | Count

Vinod  | 2

Jason | 3

[PickleRick]

We don't know if you have the fields extracted or not. If not, just do separate extractions for each of those ty[e of events extracting value to a field with the same nake.

If you, however, have the fields already extracted, do a rename or eval to get the same field name in all events.

Then you can easily aggregate all events.