index = pcf_logs cf_org_name = creorg OR cf_org_name = SvcITDnFAppsOrg cf_app_name=VerifyReviewConsumerService host="*" | eval message = case(like(msg,"%Auto Approved%"), "Auto Approved", like(msg,"%Auto Rejected%"), "Auto Rejected",1=1,msg)|stats sum(Count) as Count by message | table message Count
I am having msg in event which contains Auto Approve or Auto Rejected in between a big sentence
I want to count auto approve and auto rejected events but it doesn't give the expected result.
index = pcf_logs cf_org_name = creorg OR cf_org_name = SvcITDnFAppsOrg cf_app_name=VerifyReviewConsumerService host="*" | eval msg = case(like(msg,"%Auto Approved%"), "Auto Approved", like(msg,"%Auto Rejected%"), "Auto Rejected", like(msg,"%manual review%"),"Manual Review")|stats count by msg | table msg, count
this worked perfectly just incase any one interested thanks
index = pcf_logs cf_org_name = creorg OR cf_org_name = SvcITDnFAppsOrg cf_app_name=VerifyReviewConsumerService host="*" | eval msg = case(like(msg,"%Auto Approved%"), "Auto Approved", like(msg,"%Auto Rejected%"), "Auto Rejected")|stats count by msg | table count, msg
able to get the grouping but visualization for pie chart says need numeric data
You don't need the table command at the end for the visualization; remove it and it should work.
Can you provide an anonymized sample event?
Also, what IS the unexpected result you are getting?