eval with wildcard

[Mike6960]

I am trying to use an eval but there is a wildcard so I noticed this does not work. Ho can I get this to work? I tried using match or Like but I cant get it working

......count(eval(logger ="blablabla test HTTP status: 200.")) OR logger="something id * HTTP status: 200") AS Example

[manjunathmeti]

If you are counting logs with status code 200, then extract status from logger and count it. You can use extracted field to count logs with other status codes also.

| rex field=logger "status:\s(?<status>[\d]+)" | stats count(eval(status=200)) AS count

[kamlesh_vaghela]

@Mike6960

You can try this also.

YOUR_SEARCH | eval example= case(like(logger,"blablabla test HTTP status: 200."),1,like(logger,"something id % HTTP status: 200"),1,1=1,0) | stats sum(example) as example

Sample:

| makeresults 
| eval logger="blablabla test HTTP status: 200.|something id 1234 HTTPA status: 200|something id 1234 HTTP status: 200", logger=split(logger,"|") 
| mvexpand logger
| rename comment as "Upto this is for data generation only" 
| eval example= case(like(logger,"blablabla test HTTP status: 200."),1,like(logger,"something id % HTTP status: 200"),1,1=1,0)
| stats sum(example) as example

[nickhills]

Try
|stats count(eval(like(logger,"%status: 200"))) as Example

[shashank_24]

This works like a charm. Thanks

[Mike6960]

Hi, what does 'category' do ?

[nickhills]

sorry - should have been logger - amended in the answer.