I have the following query created:
index=my_idx source=mySource | stats count by sourceTopic
Which gives me result like:
MY/EVENTS/EV1/TYPE1 | 16170
MY/EVENTS/EV1/TYPE2 | 3558
MY/EVENTS/EV1/TYPE3 | 419
MY/EVENTS/EV2/TYPE1 | 123391
MY/EVENTS/EV2/TYPE2 | 16734
MY/EVENTS/EV2/TYPE3 | 880
But I would need my result like:
TYPE1 EV1 | 16170
TYPE2 EV1 | 3558
TYPE3 EV1 | 419
TYPE1 EV2 | 123391
TYPE2 EV2 | 16734
TYPE3 EV2 | 880
How would I achieve this? How can I rename my values that I obtain in stats?
In general, the replace command can be use to change values in stats results.
| stats count by sourceTopic
| replace "foo" with "bar" in sourceTopic
That probably won't do the job in this case, though.
We can use rex to extract the desired parts from the sourceTopic field and then rearrange them.
| rex field=sourceTopic "[^\/]+\/[^\/]+\/(?<f3>[^\/]+)\/(?<f4>.*)"
| eval sourceTopic = f4 . " " . f3
| table sourceTopic count
Thanks much @richgalloway !! It worked!
In general, the replace command can be use to change values in stats results.
| stats count by sourceTopic
| replace "foo" with "bar" in sourceTopic
That probably won't do the job in this case, though.
We can use rex to extract the desired parts from the sourceTopic field and then rearrange them.
| rex field=sourceTopic "[^\/]+\/[^\/]+\/(?<f3>[^\/]+)\/(?<f4>.*)"
| eval sourceTopic = f4 . " " . f3
| table sourceTopic count