Since you have provided more sample data and stated what the common field across the events are, I think a search like this may work.
<base_search>
| rex field=_raw "Priority\=(?<Priority>[^\,]+)"
| rex "(?:\={3}\>|\<\-{3})\s+TRN[^\:]*\:\s+(?<trn>[^\s]+)"
| rex "RCV\.FROM\.(?<TestMQ>.*)\@"
| stats
count(eval(Priority=="Low")) as Low,
count(eval(Priority=="Medium")) as Medium,
count(eval(Priority=="High")) as High,
values(TestMQ) as TestMQ
by trn
| stats
sum(Low) as Low,
sum(Medium) as Medium,
sum(High) as High
by TestMQ
| addtotals fieldname="TotalCount"
This is what the final result looks like running against the sample data you provided.
Since you have provided more sample data and stated what the common field across the events are, I think a search like this may work.
<base_search>
| rex field=_raw "Priority\=(?<Priority>[^\,]+)"
| rex "(?:\={3}\>|\<\-{3})\s+TRN[^\:]*\:\s+(?<trn>[^\s]+)"
| rex "RCV\.FROM\.(?<TestMQ>.*)\@"
| stats
count(eval(Priority=="Low")) as Low,
count(eval(Priority=="Medium")) as Medium,
count(eval(Priority=="High")) as High,
values(TestMQ) as TestMQ
by trn
| stats
sum(Low) as Low,
sum(Medium) as Medium,
sum(High) as High
by TestMQ
| addtotals fieldname="TotalCount"
This is what the final result looks like running against the sample data you provided.
Is there a common field across the two types of events to correlate them together?
Since the field TestMQ and Priority are contained in separate events then just doing a simple stats using TestMQ as a by-field will not work.
But if there is some way to stitch the two event type together first, then you could make it work.
I am not familiar enough with the data and the sample size is too small to figure out what that correlation field may be (if it exists at all) but I did put this together as a proof of concept.
Example:
<base_search>
| rex "(?:\={3}\>|\<\-{3})\s+TRN[^\:]*\:\s+(?<trn>[^\s]+)"
| rex "RCV\.FROM\.(?<TestMQ>.*)\@"
``` using this rex as a demonstration of an example of correlation field to link events together ```
| rex "\d+\s+\d{2}(?:\:\d{2}){2}\s+\d+\s+(?<corr_field>[^\:]+)"
| bucket span=30m _time
``` attribute extracted TestMQ field values to events with the same correlation field and close proximity in time ```
| eventstats
values(TestMQ) as TestMQ
by _time, corr_field
``` we can now filter down to events with Priority field available now that they have a TestMQ value contribution ```
| where isnotnull(Priority)
| chart
count as count
over TestMQ
by Priority
| addtotals fieldname="TotalCount"
| fields + TestMQ, Low, Medium, High, TotalCount
Results would look something like this (but probably with more rows with live data)
I would have selected "host" as the correlation field for the example but with the 5 sample events, "testserver1.com" didn't appear to have any TestMQ attribution. So I just extracted "testget1" since that was a common value in the logs. I'm not stating this is the correct correlation field by any-means, just for demonstration purposes only.
Edit:
And I think you could probably do something similar without using an eventstats command provided a corr_field exists with a 1-to-1 mapping with TestMQ value.
<base_search>
| rex "(?:\={3}\>|\<\-{3})\s+TRN[^\:]*\:\s+(?<trn>[^\s]+)"
| rex "RCV\.FROM\.(?<TestMQ>.*)\@"
| rex "(?:\={3}\>|\<\-{3})\s+TRN[^\:]*\:\s+(?<trn>[^\s]+)"
| rex "RCV\.FROM\.(?<TestMQ>.*)\@"
``` using this rex as a demonstration of an example of correlation field to link events together ```
| rex "\d+\s+\d{2}(?:\:\d{2}){2}\s+\d+\s+(?<corr_field>[^\:]+)"
| stats
count(eval(Priority=="Low")) as Low,
count(eval(Priority=="Medium")) as Medium,
count(eval(Priority=="High")) as High,
values(TestMQ) as TestMQ
by corr_field
| fields + TestMQ, Low, Medium, High
| addtotals fieldname="TotalCount"
