I am trying to use an eval but there is a wildcard so I noticed this does not work. Ho can I get this to work? I tried using match or Like but I cant get it working
......count(eval(logger ="blablabla test HTTP status: 200.")) OR logger="something id * HTTP status: 200") AS Example
If you are counting logs with status code 200, then extract status from logger and count it. You can use extracted field to count logs with other status codes also.
| rex field=logger "status:\s(?<status>[\d]+)" | stats count(eval(status=200)) AS count
@Mike6960
You can try this also.
YOUR_SEARCH | eval example= case(like(logger,"blablabla test HTTP status: 200."),1,like(logger,"something id % HTTP status: 200"),1,1=1,0) | stats sum(example) as example
Sample:
| makeresults
| eval logger="blablabla test HTTP status: 200.|something id 1234 HTTPA status: 200|something id 1234 HTTP status: 200", logger=split(logger,"|")
| mvexpand logger
| rename comment as "Upto this is for data generation only"
| eval example= case(like(logger,"blablabla test HTTP status: 200."),1,like(logger,"something id % HTTP status: 200"),1,1=1,0)
| stats sum(example) as example
Try
|stats count(eval(like(logger,"%status: 200"))) as Example
This works like a charm. Thanks
Hi, what does 'category' do ?
sorry - should have been logger - amended in the answer.