How do I cut a string after a certain text and count the results of the string before the cut?

[iambobwall]

Here is my current search in Jboss Logs:

index=jboss_app CLASS="foo.bar.bas.classname" MESSAGE="Error doing the thing bob wants to do" OR MESSAGE="Error doing the thing joe wants to do"|stats count by MESSAGE |sort - count

Results show

Error doing the thing for **bob** :user1@company.com AccountNumber01: 4920406079372  13
Error doing the thing for **bob** :user2@company.com AccountNumber01: 4079379507040  12
Error doing the thing for **joe** :user3@company.com AccountNumber01: 1040683729965  11 
Error doing the thing for **joe** :user4@company.com AccountNumber01: 60284967030205  10 

The results I want are to simply count how many results show "Error doing the thing for bob" and "Error doing the thing for joe" and list it as such. Just need to count how many for each.

Thanks!

[renjith_nair · Accepted solution]

@iambobwall,

There are multiple ways to do using regex.

If you want "everything" before the "text", then try

|rex field=MESSAGE "(?P<MY_MESSAGE>^(.*?))bob"    --  Result : Error doing the thing

^(.*?) will match everything until it finds the text bob. This could be used if you have a common string (e.g. bob) in every line. You could also use ":" to include bob also part of the string.

|rex field=MESSAGE "(?P<MY_MESSAGE>^(.*?)):"    --  Result : Error doing the thing bob

OR

Use below to search for first 6 words literally if the error message's format is same.

|rex field=MESSAGE "(?P<MY_MESSAGE>(\w+\s){6})"    --  Result : Error doing the thing for bob

Try and let's know if you need any changes to these

[iambobwall]

I tried the "rex" option and it worked like a charm. Thank you!

|rex field=MESSAGE "(?P <\MULTI_SINGLE>\ (\w+\s){11})"|stats count by MULTI_SINGLE|sort - count

Gives me exactly the format and information I am looking for.