I have raw data events that contain the words "Request" or "Response" or "Offer". Each event will contain only one of these strings, but it will maybe have the string several times in the event. I want to count the how many events contain "Offer" and how many events contain "Response" and how many events contain "Request"..this should be easy but I am struggling to get it right, any help will be appreciated
you could add in an eval like this:
|eval fieldCount=if(like(_raw,"%Request%") OR like(_raw,"%Response%") OR like(_raw,"%Offer%"),1,0)|stats sum(fieldCount) as total by eventIdentifier
Thank for the quick reply, but I need a count for each
Your Base Search Here | stats count AS Total count(eval(searchmatch("Request"))) AS Requests count(eval(searchmatch("Response"))) AS Response count(eval(searchmatch("Offer"))) AS Offer
Oh, you need to see at least three different ways to do this, so here's another...
If the words are always capitalized exactly as you had them...
your search here | rex "(?<rectype>Request|Response|Offer)" | stats count by rectype
...or if they might vary...
your search here | rex "(i)(?<rectype>Request|Response|Offer)" | eval rectype=lower(rectype) | stats count by rectype