Search for multiple strings and put into one line chart.

[mdavis43]

I have a search that currently has 3 search terms...

host="s2a*" "Command Aborted" OR "Internal queue full" OR "Aborting CMD"

I want to put this into a line chart by number of occurrences returned. One line per search term. Can someone point me in the right direction?

Thanks

[yannK · Accepted solution]

as per answer from Kristian, here is a regex way to do it (considering that an event has only one of those strings).

host="s2a*" "Command Aborted" OR "Internal queue full" OR "Aborting CMD" | rex "(?< myfabulousfield >(Command Aborted|Internal queue full|Aborting CMD))" | stats count by myfabulousfield

[qtorque95]

in the "rex" you meant "regex", right? If "regex" what will be the proper Splunk statement to run your suggested answer? Thanks.

[mdavis43]

Thanks, that worked just fine. I replaced stats with timechart and it gave me the results I was looking for.

[kristian_kolb]

You need to extract the strings above into a field, e.g. my_field

then you run your search like;

... | timechart c by my_field