Hello,
I have a field that contains the string below.
a) There can be fewer/more than the 4 events listed below.
b) Value of the events will be different.
(event=aa)(event=bb)(event=cc)(event=normal)
=====================================================
1) How can I create a new field events that equals "aa,bb,cc,normal"?
2) Is there a way to exclude the normal event? So field events = "aa,bb,cc" only?
3) Is there a way to make it list like so I can filter on these events values? (ie - potentially count # of events with aa or cc or (aa + cc)?)
4) Is there a way to count the events returned in the field?
Thank you!
Try regex
|rex field=events max_match=0 "event=(?<EVENTS>.+?)\)"
From the result, you can do rest of the stats
Sample data
|makeresults|eval events="(event=aa)(event=bb)(event=cc)(event=normal) (event=xx)(event=yy)(event=zz)(event=normal)"|makemv events|mvexpand events|streamstats count as uniqueField
|rex field=events max_match=0 "event=(?<EVENTS>.+?)\)"
|eval Total=mvcount(EVENTS)
|stats count as event_count,max(Total) as Total by EVENTS,uniqueField
Let's know your final output format. We can fine tune w.r.t count and total
Try regex
|rex field=events max_match=0 "event=(?<EVENTS>.+?)\)"
From the result, you can do rest of the stats
Sample data
|makeresults|eval events="(event=aa)(event=bb)(event=cc)(event=normal) (event=xx)(event=yy)(event=zz)(event=normal)"|makemv events|mvexpand events|streamstats count as uniqueField
|rex field=events max_match=0 "event=(?<EVENTS>.+?)\)"
|eval Total=mvcount(EVENTS)
|stats count as event_count,max(Total) as Total by EVENTS,uniqueField
Let's know your final output format. We can fine tune w.r.t count and total
Thanks, this worked well for me! Would you know of a way to exclude values (ie - normal)?
Thank you!
Sure. Just add this after the rex command
|eval EVENTS=mvfilter(!match(EVENTS,"normal"))