Search for a string that occurs more than once

[c799651]

I'm trying to search for a string that occurs more than once. But the string contains wildcards and commas.

Which query will find if the following string occurs more than once ?

"BLOCK,%,%,1"

Where the % is a wildcard. (it is always an integer)

[493669]

Try below-

|rex  max_match=0 "BLOCK,\d*,\d*,(?<block>\d)"|where mvcount(block)>0

below is using sample data-

|makeresults|eval _raw ="BLOCK,1,2,1
BLOCK,2,1,1"
|append[|makeresults|eval _raw ="BLOCK,1,2,1"]
|rex  max_match=0 "BLOCK,\d*,\d*,(?<block>\d)"|where mvcount(block)>0

[c799651]

Thanks. This will find all events that contain a sting matching this critrea.

I was unclear in my question. I would also like find events that match this string more than once .

I may have 1000 records, 997 that contain this string once and 3 conatin this sting more than once. I want to find the 3 records with the sting more than once.

Thanks again

[to4kawa]

index=yours TERM("BLOCK")
| regex "BLOCK,\d*,d*,1"