so the expected status result should comes from below two events
2019-12-04 18:39:14,890 # kf7=adequatT1_301 # ktf1=[liveProfile,compensation,Others]
2019-12-04 18:45:14,890 # kf7=adequatT1_302 # ktf1=[performance]
The stats result should be below:
I have draft the query like below, but can't figure out how to stats by ktf1 as next step. Could you please help?
Hey - so when I ran your search I hit an error with the regex so I wrote my own, and also your two 301 kf7 values have the same timestamp so you should probably figure out how you want to handle that case. That being said, something like this does get your expected output:
I parse out the timestamp, ktf7value, and ktf1value, convert the timestamp back into the _time field as you need that for any time calls (latest/timechart/etc), take the latest ktf1value by ktf7, split out the fields to make them into a multivalue field to expand them to count by them. https://regex101.com/ is a good site for testing regex for what it's worth.