How do I get all the values.

[chappe4]

I have tried this

source=/var/log/testlog "EXP" OR "Q up" OR "X listing" | rex "(?<myword>EXP|Q up|X listing)" | stats count by myword

But I get the result

Myword          Count
EXP             23
X listing       55

How do I get all the three results? And also get a pie chart or it?
//Chappe4

[chappe4]

Thanks the solution did work.

[Ayn]

Awesome. Could you please mark my answer as accepted? Thanks!

[Ayn]

If you're not seeing "Q up" in your stats table, that's either because it wasn't found in any of the events, or more likely because the events with the text "Q up" also contains one or more of the other values in your regex. By default rex will only match one time per event, so if you have an event with this text:

blabla EXP blabla Q up blablabla

rex will only extract "EXP" into your myword field. To have it match more than once, use the argument max_match which controls how many times rex is allowed to match within an event (default is, obviously, 1).

So for instance to allow rex to match 3 times, your search would be modified like this:

source=/var/log/testlog "EXP" OR "Q up" OR "X listing" | rex max_match=3 "(?<myword>EXP|Q up|X listing)" | stats count by myword

This should yield the results you're looking for. To get a pie chart of it, if you're in the search app, click the "Build report" link to the right, choose "pie" as the chart type and apply.

[alanwds]

This work for me.

Thank you very much!