Splitting results by matched conditions

[mahesh27]

|tstats count where index=app-data  (TERM(Errors) TERM( Started) TERM( in)  TERM(*s)  TERM(*ms))  OR (TERM(system)  TERM(restart))

when i run the above query i am getting overall(combined) results. but i want to see the results for each and every string  separately which i mentioned in the query.

how can i do that????

[PickleRick]

You can't do that. Splunk doesn't keep track of which part of the condition was matched on a particular result line. And you can only split your aggregation on a field or prefixed value.

[mahesh27]

Ok if that is a case we can do without tstats using eval command

May I know how can I do that

[PickleRick]

I don't quite follow, to be honest.

Of course you could go through a list of terms to match  over event by event and set a field in case it matched but it will be way way way worse performance-wise.