Grouping by the words in a field

[H2ck1ngPr13sT]

HI,

I have a below query, I want to group and count by two different words, one group per word, in a field "text1.value"  which are Load Balancer and Endpoints words are located somewhere in a string. Also I want to count how many of them occured per one day. 

Is this possible?

index=monitor name="Manager - Error" text2.value="*Rerun"  text1.value="*Load Balancer*" OR "*Endpoints*"

[gcusello]

Hi @H2ck1ngPr13sT ,

if you want your count for one day, you could use something like this:

index=monitor name="Manager - Error" text2.value="*Rerun"  text1.value IN ("*Load Balancer*", "*Endpoints*") earliest=-1d latest=now
| rename text1.value AS text1_value
| stats 
     count(eval(searchmatch(text1_value,"Load Balancer"))) AS LoadBalancer
     count(eval(searchmatch(text1_value,"Endpoints"))) AS Endpoints

if instead yu want the values for each day in the last 7 days, you could use something like this:

index=monitor name="Manager - Error" text2.value="*Rerun"  text1.value IN ("*Load Balancer*", "*Endpoints*") earliest=-17 latest=now
| rename text1.value AS text1_value
| eval type=if(searchmatch(text1_value,"Load Balancer"),"LoadBalancer", "Endpoints")
| timechart span=1d count BY type

Ciao.

Giuseppe

[H2ck1ngPr13sT]

Unfortunately, I'm getting error: "Error in 'EvalCommand': The arguments to the 'searchmatch' function are invalid." I've tried both solutions.

[gcusello]

Hi @H2ck1ngPr13sT ,

sorry I confused searchmatch with match, please use match function.

Ciao.

Giuseppe

[yuanliu]

Replace searchmatch(text1_value,"Load Balancer") with searchmatch("text1_value=\"*Load Balancer*\""), and so on.  BTW, rename is not needed for searchmatch because it accepts any syntax/shortcut that the search command accepts. (Like search, it also does case-insensitive match.)  For example,

index=monitor name="Manager - Error" text2.value="*Rerun"  text1.value IN ("*Load Balancer*", "*Endpoints*") earliest=-1d latest=now
| stats 
     count(eval(searchmatch("text1.value=\"*Load Balancer*\""))) AS LoadBalancer
     count(eval(searchmatch("text1.value = \"*Endpoints*\""))) AS Endpoints