How to extract an unmapped field in the stats table from logs?

[Nidd]

I am trying to extract the value of an unmapped field from logs. I have logs where the status could either be ERROR or FATAL.

This way:

Type 1:

 [2/13/18 22:54:45:880 MST] 00000ea2 SystemOut     O ERROR: CustomerServices - [Log_CustomerService_FailedToInvokeMDMServer:] Failed to invoke MDM Server <?xml version="1.0" encoding="UTF-8"?>
    ... 36 lines omitted ...
                    <ErrorMessage>The following is required: Language or Locale</ErrorMessage>
                    <ErrorType>FVERR</ErrorType>
    ... 44 lines omitted ...
                    <ErrorMessage>The following is required: Language or Locale</ErrorMessage>
                    <ErrorType>FVERR</ErrorType>
    Show all 108 lines
    host = p01aml214 source = /env/IBM/logs/Custom01/SystemOut.log sourcetype = MDM:PROD:LOG

Type 2:

[2/13/18 22:54:45:990 MST] 00000ea2 SystemOut     O FATAL: CustomerServices - [Log_CustomerService_FailedToInvokeMDMServer:] Failed to invoke MDM Server <?xml version="1.0" encoding="UTF-8"?>
... 36 lines omitted ...
                <ErrorMessage>The following is required: Language or Locale</ErrorMessage>
                <ErrorType>FVERR</ErrorType>
... 44 lines omitted ...
                <ErrorMessage>The following is required: Language or Locale</ErrorMessage>
                <ErrorType>FVERR</ErrorType>
Show all 108 lines
host = p01aml214 source = /env/IBM/logs/Custom01/SystemOut.log sourcetype = MDM:PROD:LOG

I need the status table like:

source                                status   count
/env/IBM/logs/Custom01/SystemOut.log    ERROR   2
/env/IBM/logs/Custom01/SystemOut.log    FATAL   3

The count being the number of logs having ERROR/FATAL scenario.

I have no idea how to retrieve this unmapped field. Could someone please help?

Thanks.

[FrankVl · Accepted solution]

Assuming those particular strings don't occur anywhere else in these events, you could try:

...your search... | rex "(?<status>ERROR|FATAL):" | stats count by source,status

You can make it a bit more robust by adding some more context around the capture group to make sure it doesn't capture occurences of these strings from elsewhere in the event if needed.

[Nidd]

Clear ! Thanks a lot @FrankVI.