Extracted fields in same table

[SS1]

Hi,

I have extracted 2 fields i.e. field1 & field2, while using the stats count command how do i use these extracted fields so that they show up in same table like below

source     issue      _time

userx       field1         12:00

usery        field1          13:00

userz         field2         14:00

Or should i use 2 different tables for  field1 and field2

below are the searches i am using

index=test1 | rex field=source "\\\\(?<source>\w+)-(?<issue>\w+)\.log$" | stats count by source,_time,field1| sort -_time| fields source,_time,field1

index=test1 | rex field=source "\\\\(?<source>\w+)-(?<issue>\w+)\.log$" | stats count by source,_time,field2 | sort -_time| fields source,_time,field2

[SS1]

Sorry, i phrased the table wrong. field 1 and field2 are does not fall under issue

below is how i need the table,

source     Notification      _time

userx       field1                 12:00

usery        field1                13:00

userz         field2                14:00

[manjunathmeti]

Then you can append 2nd query results to first one:

index=test1 | rex field=source "\\\\(?<source>\w+)-(?<issue>\w+)\.log$" | stats count by source,_time,field1| sort -_time| fields source,_time,field1 | eval Notification="field1" | append [ search index=test1 | rex field=source "\\\\(?<source>\w+)-(?<issue>\w+)\.log$" | stats count by source,_time,field1 | sort -_time| fields source,_time,field2 | eval Notification="field2"] | fields Notification, source, _time| stats max(source) as source, max(_time) as _time by Notification

[manjunathmeti]

hi @SS1,

If field1 and field2 are values of field issue, then you only need one query:

index=test1 | rex field=source "\\\\(?<source>\w+)-(?<issue>\w+)\.log$" | stats count by source,issue,_time | fields -count