I have a search base like below and want to put the count as 1.
index=index1 test machine is not responding java.lang.NullPointerException as "test" | stats count by test | dedup test
My count is 0
The stats commands works upon the fields. Assuming whatever string you've on base search you want to show count of it, Try one of following methods.
index=index1 test machine is not responding java.lang.NullPointerException | stats count | eval test="test machine is not responding java.lang.NullPointerException " | table test count
OR
index=index1 test machine is not responding java.lang.NullPointerException | rex "(?<test>test machine is not responding java.lang.NullPointerException)" | stats count by test
Thanks. let me try it.
can i do soemthing like this, it works but not gettign any result
index=index1 test machine is not responding java.lang.NullPointerException as "testmachine" | stats count by testmachine
No you can't. YOu can't assign a field name to a string. You would need to have it extracted (like option 2) before you could use it.