Okay too slow in the morning hours 😉
here is my answer anyway:
| makeresults | eval foo="\nCDIARIA2 \nCDIARIAC \nMAROV91 \nMAFTB87 \nMATBU90" | makemv foo | mvexpand foo | eval jobname=ltrim(foo,"\n") | stats count by jobname
The first 4 lines are just to produce dummy data, the
ltrim() is the one you can use to remove unwanted characters from the left.
@somesoni2, it is neat, but performance wise yours is better because you are performing the replace after the stats (hence working on less events rather than all). On similar lines, following would be a faster search.
<BaseSearch> | stats count by jobname | eval jobname=ltrim(foo,"\n")
Try like this (run anywhere sample search, just add the last eval line to your existing search)
| gentimes start=-1 | eval jobname="\nCDIARIA2 \nCDIARIAC \nMAROV91 \nMAFTB87 \nMATBU90" | makemv jobname | mvexpand jobname | stats count by jobname | eval jobname=replace(jobname,"\\\n","")
Hello MuS! Thanks for your answer.
This is the query I'm using
index=mf JCL ERROR* |stats count by jobname
An it brings me this but I don't want the \n