Sub Search counts

[SUNRAJ]

I have filed called serial_id which have value ABC2022100845001 

I need count with contain 45  in last 5 & 6 th bytes 

[somesoni2 · Accepted solution]

Try this:

Your base search | regex serial_id=".+45...$" | stats count

[SUNRAJ]

yes it works-  if i need another value like 45 and 47 in sub search and counts in table with distinct counts ?

[SUNRAJ]

yes it works-  if i need another value like 45 and 47 in sub search and counts in table with distinct counts ?

[SUNRAJ]

yes it works-  if i need another value in sub search and counts in table with distinct counts ??

[ITWhisperer]

base search 
| rex field=serial_id ".+(?<marker>..)...$" 
| stats count by marker