Hi all,
I would like to know if there is a way to group multiple values from repeated fields that are coming in the same log, for example, taking into account the following log event containing the following data:
Log1: moduleName="Module A" moduleType="TypeA" moduleName="Module B" moduleType="TypeB"
Log2: moduleName="Module C" moduleType="TypeC" moduleName="Module A" moduleType="TypeA"
I tried something like:
app_search_criteria | stats count by moduleName | sort -count
But this way it's only bringing data for the first moduleName field it finds in one log and not for all of them, for example, I'm getting the following table:
moduleName count
ModuleA 1
ModuleC 1
The ideal approach would be:
moduleName moduleType count
ModuleA TypeA 2
ModuleB TypeB 1
ModuleC TypeC 1
Thanks in advance!
app_search_criteria
| rex max_match=0 "(?<nametype>moduleName=\"[^\"]+\" moduleType=\"[^\"]+\")"
| mvexpand nametype
| rex field=nametype "moduleName=\"(?<moduleName>[^\"]+)\" moduleType=\"(?<moduleType>[^\"]+)\""
| stats count by moduleName moduleType
| sort -count
app_search_criteria
| rex max_match=0 "(?<nametype>moduleName=\"[^\"]+\" moduleType=\"[^\"]+\")"
| mvexpand nametype
| rex field=nametype "moduleName=\"(?<moduleName>[^\"]+)\" moduleType=\"(?<moduleType>[^\"]+)\""
| stats count by moduleName moduleType
| sort -count
Hi @ITWhisperer , thanks very much that did the trick!