distinct count

[Mike6960]

I have events which contain batches. There are several batchtypes. For example Batch; A01,A02,A03.
When a batch is started it is stored for example like this: A01-sample-2019-03-20-mm. I want to count the number of batches per batchtype per moment (2019-03-20)

Now I have this: ....search...... | stats distinct_count(batch) as count by batch| table batch count

[vnravikumar · Accepted solution]

Hi

Give a try

| makeresults 
| eval msg="A01-sample-2019-03-20-mm,A01-sample-2019-03-20-mm,A01-sample-2019-03-21-mm" 
| makemv delim="," msg 
| mvexpand msg 
| rex field=msg "(?P<batch>^[^-]+)(\-\w+\-)(?P<date>\d{4}-\d{2}-\d{2})" 
| stats count by batch,date