How to group by the to= values, so I can count the number of times they repeat, create charts, and other metrics?

[Stephcg]

Hello!
I have many events, and I have a search that returns only the events that contain the to field.

index="my_index_qa"    sourcetype="example-qa" to=*

The results are a list of events that have the following pattern:

	
db271cf8678c -2023-01-12 15:08:32.157 [app=app-name, traceId=traceid-value, spanId=spanid-value,  INFO 1 [llEventLoop-5-5] filter.FilterBeingUsed   : c=class, m=method, method=GET, to=http://example.url.com/path/extra, route=https://example.url.com/redirect/route, headers={X-Forwarded-For=[IPADDRESS, IPADDRESS2], X-Forwarded-Proto=[http], X-Forwarded-Port=[80], Host=[EXAMPLE-HOST], app-device=[DEVICE-INFO], app-user=[devicce-info-os-info], app-os=[APP-OS-VERSION], user-agent=[user-agent-example], app-version=[app.version.example], Origin=[origin-app]}

I want to be able to group by the to= values, so I can count the number of times they repeat, create charts and do some other metrics.

Is it possible? How can I do this?

Thank you for any help in advance. And sorry if I wrote anything wrong, english is not my main language.

[Stephcg]

That helped! Thank you a lot! 😊

[richgalloway · Accepted solution]

Have you tried this?

index="my_index_qa"    sourcetype="example-qa" to=*
| stats count by to

Any time you want to count something, use stats (or eventstats or streamstats or timechart) count.  Grouping by a field implies the by option.