I'm trying to search for a string that occurs more than once. But the string contains wildcards and commas.
Which query will find if the following string occurs more than once ?
"BLOCK,%,%,1"
Where the % is a wildcard. (it is always an integer)
Try below-
|rex max_match=0 "BLOCK,\d*,\d*,(?<block>\d)"|where mvcount(block)>0
below is using sample data-
|makeresults|eval _raw ="BLOCK,1,2,1
BLOCK,2,1,1"
|append[|makeresults|eval _raw ="BLOCK,1,2,1"]
|rex max_match=0 "BLOCK,\d*,\d*,(?<block>\d)"|where mvcount(block)>0
Thanks. This will find all events that contain a sting matching this critrea.
I was unclear in my question. I would also like find events that match this string more than once .
I may have 1000 records, 997 that contain this string once and 3 conatin this sting more than once. I want to find the 3 records with the sting more than once.
Thanks again
index=yours TERM("BLOCK")
| regex "BLOCK,\d*,d*,1"