Hi
need to find error codes then due to ID, count number of IPS.
2021-12-26 22:38:59,248 INFO CUS.AbCD-Server-2-0000000 [LoginService] load idss[IPS=987654*1234-1,productCode=000]
2021-12-26 22:38:59,280 ERROR CUS.AbCD-Server-2-0000000 [LoginService] authorize: [AB_100] This is huge value. ConfigApp[DAILY_STATIC_SECOND_PIN]
2021-12-26 22:38:59,248 INFO CUS.AbCD-Server-2-0000000 [LoginService] load idss[IPS=987654*1234-1,productCode=000]
2021-12-26 22:38:59,280 ERROR CUS.AbCD-Server-2-0000000 [LoginService] authorize: [AB_100] This is huge value. ConfigApp[DAILY_STATIC_SECOND_PIN]
2021-12-26 22:38:59,248 INFO CUS.AbCD-Server-3-9999999 [LoginService] load idss[IPS=123456*4321-1,productCode=000]
2021-12-26 22:38:59,280 ERROR CUS.AbCD-Server-3-9999999 [LoginService] authorize: [AB_500] This is huge value. ConfigApp[DAILY_STATIC_SECOND_PIN]
expected output:
ID IPS count
CUS.AbCD-Server-2-0000000 987654*1234-1 2
CUS.AbCD-Server-2-9999999 123456*4321-1 1
Any idea?
Thanks,
| makeresults
| eval _raw="2021-12-26 22:38:59,248 INFO CUS.AbCD-Server-2-0000000 [LoginService] load idss[IPS=987654*1234-1,productCode=000]
2021-12-26 22:38:59,280 ERROR CUS.AbCD-Server-2-0000000 [LoginService] authorize: [AB_100] This is huge value. ConfigApp[DAILY_STATIC_SECOND_PIN]
2021-12-26 22:38:59,248 INFO CUS.AbCD-Server-2-0000000 [LoginService] load idss[IPS=987654*1234-1,productCode=000]
2021-12-26 22:38:59,280 ERROR CUS.AbCD-Server-2-0000000 [LoginService] authorize: [AB_100] This is huge value. ConfigApp[DAILY_STATIC_SECOND_PIN]
2021-12-26 22:38:59,248 INFO CUS.AbCD-Server-3-9999999 [LoginService] load idss[IPS=123456*4321-1,productCode=000]
2021-12-26 22:38:59,280 ERROR CUS.AbCD-Server-3-9999999 [LoginService] authorize: [AB_500] This is huge value. ConfigApp[DAILY_STATIC_SECOND_PIN]"
| multikv noheader=t
| table _raw
| rex "\S+\s+\S+\s+INFO\s+(?<ID>\S+).*idss\[IPS=(?<IPS>[^,]+)"
| rex "\S+\s+\S+\s+(?<status>ERROR)\s+(?<ID>\S+)"
| stats values(IPS) as IPS list(status) as status by ID
| stats count by ID IPS status