I would like group result

[dieusplunk]

I have this request :

sourcetype="accouting" fichier="*.log" | stats count by fichier

Here is the result :

fichier count
DIAEAEF*.log    7
DIAEAU97*.log   1
DIAEHAB*.log    5
DIAEHF*.log 9
DIAEPJ*.log 5
DIAEWF*.log 2
DIAEHP*.log 2

---

And I'd like to gather some files to have another table as follows :

paquet  count
AA  12
BB  6
CC  13

Explain :

AA = DIAEAEF*.log + DIAEHAB*.log
BB = DIAEAU97*.log + DIAEPJ*.log
CC = DIAEHF*.log + DIAEWF*.log + DIAEHP*.log

---

sorry for my english... thanks google translate 😉

[sideview]

Sounds like you want a file-based lookup to define themapping from fichier to paquet. If you created that lookup and called it fichier_to_paquet,and gave it the lookup of:

fichier,paquet
DIAEAEF*.log,AA
DIAEAU97*.log,BB
DIAEHAB*.log,AA
DIAEHF*.log,CC
DIAEPJ*.log,BB
DIAEWF*.log,CC
DIAEHP*.log,CC

then you could have

... | lookup fichier_to_paquet | stats count by paquet

That way you don't even have the| stats count by fichier clause at all - you just use the lookup to get paquet fields on the event rows, and then use stats to group by paquet.