Hi! I'm a new user and have begun using this awesome tool. I've got a question about how to group things, below.
Suppose I have a log file that has 2 options for the field host: host-a, host-b and 2 different users. The users are turned into a field by using the rex filed=_raw command.
This command will tells how many times each user has logged on:
index=spss earliest=-25h "Login succeeded for user" | rex field=_raw ".*Login succeeded for user: (?.*)" | stats count by user
This command will tells how many times each user has logged into each server
index=spss earliest=-25h "Login succeeded for user" | rex field=_raw ".*Login succeeded for user: (?.*)" | stats count by user host
It gives an output that looks something like the following:
user..........host..........count
user1........host-a..........2
user2........host-b..........5
user2........host-a..........3
How can I modify the post to get a unique list of how many people have logged onto each host e.g.
host..........count
host-a............2
host-b............1
I essentially want to group by user, but am not sure of how to do that. Thanks in advance!
