Log messages counts are getting overlapped in splunk dashboard?

[Aryc090908]

Index=dev log-severity=INFO app name=abcd | rex “tv counts for indicator S = (?<Count>\d+)” | stats count by _time, Counts l table _time, counts

I have two queries separately 

1) tv counts for indicator S= (?<Count>\d+)

2) Dishtv counts for indicator S= (?<Count>\d+)

Both of the counts are combined because they’re having same wordings  (tv counts for indicator S= (?<Count>\d+),

spark Data frame that generates these 1 and 2 queries is different.they have different output counts but in graphs they are overlapping because of same logger messages wording.

how can I get separate counts for each of them separately 

pls suggest 

[richgalloway]

To get separate counts, count them separately using different regular expressions.

index=dev log-severity=INFO app name=abcd 
| rex "dishtv counts for indicator S = (?<dishCount>\d+)"
| rex "\btv counts for indicator S = (?<tvCount>\d+)"
| table _time, dishCount, tvCount

That said, it's not clear what the goal of the original query is.  What is the desired output?

[Aryc090908]

For dishtv the graph is looking fine,

for tv while the line graph is created on dash board bcz of the regex pattern, it was displaying both dish tv counts and tv counts in one graph i.e., the counts are overlapping. For tv how can I write that regex pattern. Used \b as you suggested but it’s giving same graph as dishtv (same counts as dishtv)

[richgalloway]

The regular expressions I provided are speculative because we don't know the full text they are to match.  In particular, what (precisely) comes before "tv counts"?  If "tv" is the first text of the event then you can substitute "\b" with "^".

[yuanliu]

It is not possible for "\btv counts for indicator S = (?<tvCount>\d+)" to pick out "Dishtv counts for indicator S=1234".  If you have data like this:

_raw	_time
Dishtv counts for indicator S = 1234	2022-11-07 21:29:42
tv counts for indicator S = 5678	2022-11-07 21:29:42

@richgalloway's code (correcting for capitalization of Dishtv) should give you

_time	dishCount	tvCount
2022-11-07 21:29:42	1234
2022-11-07 21:29:42		5678

Are you sure you entered the code correctly?  A few pointers: Always clearly state, or even illustrate/mock up your end result; make sure your code illustration is accurate (e.g., no strange quotation marks); convert any code snippet from XML dashboard source to real SPL search language (e.g., no &lt;, &gt;, etc.) unless you are illustrating an Simple XML block.

Your original code illustration really doesn't show what your intention is because it contains too many bad lettering.  If I should speculate, you want to sum up the counts of each type and plot against time?

index=dev log-severity=INFO app name=abcd 
| rex "Dishtv counts for indicator S = (?<dishCount>\d+)"
| rex "\btv counts for indicator S = (?<tvCount>\d+)"
| timechart sum(dishCount) as dishcount sum(tvCount) as tvCount

p.s. Here is a demonstration of "\btv".

| makeresults
| eval data = split("Dishtv counts for indicator S = 1234,tv counts for indicator S = 5678", ",")
| mvexpand data
| rename data AS _raw
``` the above is emulation of two data points ```
| rex "Dishtv counts for indicator S = (?<dishCount>\d+)"
| rex "\btv counts for indicator S = (?<tvCount>\d+)"
| table _time, dishCount, tvCount