I have a log where
How I want to ignore the -345 and just keep the first 3 characters and report on the occurances. The above would count for two occurrences for labelData=123.
I can't seem to figure this out using:
source=*//logs/stdout.log class=myClass | fields labelData | eval newStuff=substr(labelData, 1, 43 | stats count by newStuff | sort count | reverse
Input Note: labelData could also be 456-789. Basically, i just want to match/substr the first 3 characters.
You can try
source=*//logs/stdout.log class=myClass | fields labelData |regex lableData="123.*" | stats count by labelData | sort count | reverse
This will give you the full string in the results, but the results will only include values with the substring.
If you want to create a new field, then use rex.
source=*//logs/stdout.log class=myClass | fields labelData | rex field=labelData "^(?P<newStuff>123).*" | stats count by newStuff | sort count | reverse
For multiple possibilities you would use the OR command for regex, which is the pipe
|. For the first three characters only, use the "starts with" symbol, otherwise known as the carrot
^. I'm assuming you mean exactly 456 or 789.
To grab just the one that starts with 789, remove the OR.
This is a different answer inspired by above question and responses.
index="indexname" Type="Error"| eval messageInit=substr(Message, 1, 25)| top limit=20 messageInit