Extracting AppID(s) from whole text and group by AppId and host
txid:944::appId:3::test:
txid:944::appId:3::tes2:
txid:944::appId:4::test4:
txid:944::appId:4::tes2:
txid:944::appId:5::test4:
txid:944::appId:6::tes2:
Try something like this...
| rex "txid:(?<txid>[^:]+)::appId:(?<appId>[^:]+)::(?<host>[^:]+):"
| stats count by appId host txid
clientAppId="123123"
clientAppId="123123"
| rex "clientAppId(?[^=]+)"
| stats count by appId host
| rex "clientAppId=(?\d+)"
| stats count by appId host
i am not getting any result