I have filed called serial_id which have value ABC2022100845001
I need count with contain 45 in last 5 & 6 th bytes
Try this:
Your base search | regex serial_id=".+45...$" | stats count
yes it works- if i need another value like 45 and 47 in sub search and counts in table with distinct counts ?
yes it works- if i need another value in sub search and counts in table with distinct counts ??
base search
| rex field=serial_id ".+(?<marker>..)...$"
| stats count by marker