Let's say I have logs that look like: date,USER=Joe,ACTION=Open,RESULT=Success
If there are four different types of actions and I want to count the total number of actions by user, I would write a search like:
sourcetype=test.log | stats count(eval(ACTION="Open")) AS Open, count(eval(ACTION="Close")) AS Close, count(eval(ACTION="Read")) AS Read, count(eval(ACTION="Write")) AS Write by DATE,USER | table DATE,USER,Read,Write,Open,Close
What if there are 50 different values for ACTION? Would I have to write a monsterous search string to catch them all or is it possible to count each unique ACTION and save the count in a field with the same name as the action?