count errors with one condition

[indeed_2000]

Hi
need to find error codes then due to ID, count number of IPS.

2021-12-26 22:38:59,248 INFO CUS.AbCD-Server-2-0000000 [LoginService] load idss[IPS=987654*1234-1,productCode=000]
2021-12-26 22:38:59,280 ERROR CUS.AbCD-Server-2-0000000 [LoginService] authorize: [AB_100] This is huge value. ConfigApp[DAILY_STATIC_SECOND_PIN]

2021-12-26 22:38:59,248 INFO CUS.AbCD-Server-2-0000000 [LoginService] load idss[IPS=987654*1234-1,productCode=000]
2021-12-26 22:38:59,280 ERROR CUS.AbCD-Server-2-0000000 [LoginService] authorize: [AB_100] This is huge value. ConfigApp[DAILY_STATIC_SECOND_PIN]

2021-12-26 22:38:59,248 INFO CUS.AbCD-Server-3-9999999 [LoginService] load idss[IPS=123456*4321-1,productCode=000]
2021-12-26 22:38:59,280 ERROR CUS.AbCD-Server-3-9999999 [LoginService] authorize: [AB_500] This is huge value. ConfigApp[DAILY_STATIC_SECOND_PIN]

expected output:
ID                                                                       IPS                                     count
CUS.AbCD-Server-2-0000000   987654*1234-1     2
CUS.AbCD-Server-2-9999999   123456*4321-1     1

Any idea?

Thanks,

[ITWhisperer]

| makeresults
| eval _raw="2021-12-26 22:38:59,248 INFO CUS.AbCD-Server-2-0000000 [LoginService] load idss[IPS=987654*1234-1,productCode=000]
2021-12-26 22:38:59,280 ERROR CUS.AbCD-Server-2-0000000 [LoginService] authorize: [AB_100] This is huge value. ConfigApp[DAILY_STATIC_SECOND_PIN]
2021-12-26 22:38:59,248 INFO CUS.AbCD-Server-2-0000000 [LoginService] load idss[IPS=987654*1234-1,productCode=000]
2021-12-26 22:38:59,280 ERROR CUS.AbCD-Server-2-0000000 [LoginService] authorize: [AB_100] This is huge value. ConfigApp[DAILY_STATIC_SECOND_PIN]
2021-12-26 22:38:59,248 INFO CUS.AbCD-Server-3-9999999 [LoginService] load idss[IPS=123456*4321-1,productCode=000]
2021-12-26 22:38:59,280 ERROR CUS.AbCD-Server-3-9999999 [LoginService] authorize: [AB_500] This is huge value. ConfigApp[DAILY_STATIC_SECOND_PIN]"
| multikv noheader=t
| table _raw



| rex "\S+\s+\S+\s+INFO\s+(?<ID>\S+).*idss\[IPS=(?<IPS>[^,]+)"
| rex "\S+\s+\S+\s+(?<status>ERROR)\s+(?<ID>\S+)"
| stats values(IPS) as IPS list(status) as status by ID
| stats count by ID IPS status