How can I group multiple values from repeated fields in the same log?

[grevortex]

Hi all,

I would like to know if there is a way to group multiple values from repeated fields that are coming in the same log, for example, taking into account the following log event containing the following data:

Log1: moduleName="Module A" moduleType="TypeA" moduleName="Module B" moduleType="TypeB"

Log2: moduleName="Module C" moduleType="TypeC" moduleName="Module A" moduleType="TypeA"

I tried something like:

app_search_criteria | stats count by moduleName | sort -count

But this way it's only bringing data for the first moduleName field it finds in one log and not for all of them, for example, I'm getting the following table:

moduleName         count

ModuleA                     1

ModuleC                     1

The ideal approach would be:

moduleName         moduleType       count

ModuleA                      TypeA                   2

ModuleB                      TypeB                   1

ModuleC                      TypeC                   1

Thanks in advance!

[ITWhisperer · Accepted solution]

app_search_criteria 
| rex max_match=0  "(?<nametype>moduleName=\"[^\"]+\" moduleType=\"[^\"]+\")"
| mvexpand nametype
| rex field=nametype "moduleName=\"(?<moduleName>[^\"]+)\" moduleType=\"(?<moduleType>[^\"]+)\""
| stats count by moduleName moduleType 
| sort -count

[grevortex]

Hi @ITWhisperer , thanks very much that did the trick!