Hi, i need to count the stat based on different type of source and field (based on 1st 3 char of the filename of the field). E.g. My ultimate goal is to get a timechart of line graph showing stat based on different filetype. thks
12/7/16 12: 14 filename="ABC132323.txt" source="abc.log"
12/7/16 17: 14 filename="DEF.txt" source="def.log"
11/3/16 01: 14 filename="QDAD21.txt" source="wed.log"
08/7/16 12: 14 filename="ABC.txt" source="abc.log"
01/7/16 12: 14 filename="QD444.txt" source="abc.log"
result:
filename count
ABC* 2
DEF* 1
QD* 2
Something like this should get you started.
... | eval prefix = substr(filename, 1, 3) | stats count by prefix | ...
Something like this should get you started.
... | eval prefix = substr(filename, 1, 3) | stats count by prefix | ...