How can I tally a value that represents usage in 3 letters and get the number of events that have each?

[tirams]

I have a field lets call it usage that can up to 3 of these letters (b, n, e)
i.e. all possible logged permutations we could get are the following

1. b
2. e
3. n
4. be
5. bn
6. en
7. ben

I have a chart showing counts of these using | stats count by usage

what would also like to chart is total number of events that had usage with b, with e, and with n.
i.e. how many (and the percent of) events used each letter in any combo

to be able to see usage
b 5
e 170
n 34

and the percent of total events

[woodcock · Accepted solution]

Like this:

... | rex field=usage "(?<usage_letter>.)"
| multireport
[ stats count AS total_count | eval keep="false" ]
[ stats count BY usage_letter | eval keep="true" ]
| filldown total_count
| where keep="true"
| eval pct = 100 * count / total_count

[tirams]

Thanks @woodcock this is great! I wasn't familiar with the multireport command can you explain a bit and also on how the keep is being used? I couldn't find doc on multireport

[woodcock]

It is not documented but it forks the results at that point and passes a copy to each [] stanza and then appends the results of everything together. Please do click Accept to close the question.

[marycordova]

would the usage ben be a count of 1 each for b, e, and n and the usage be be counted as one each also so that the total count would be b=2, e=2, n=1?

can you post some of the raw data?

[tirams]

yes that is correct @marycordova
I can't really post actual events but it's would be similar to the following (I stripped out & edited lots of internal irrelevant stuff )

{"timestamp":"2016-07-11T23:34:35.968Z","thread":"****","level":"INFO",message":"Data CRUD: usage:be, numberOfModl:2"}

{"timestamp":"2016-07-11T23:24:51.671Z","thread":"****","level":"INFO","message":"Data CRUD: usage:b, numberOfModl:4"}

{"timestamp":"2016-07-11T22:56:35.413Z","thread":"****","level":"INFO","message":"Data CRUD: usage:bn, numberOfModl:3"}

{"timestamp":"2016-07-11T21:56:35.113Z","thread":"****","level":"INFO","message":"Data CRUD: usage:ben, numberOfModl:7"}

{"timestamp":"2016-07-11T20:16:35.113Z","thread":"****","level":"INFO","message":"Data CRUD: usage:en, numberOfModl:3"}

etc..