grouping by a log column

[toby53]

How can I do a group by on a log column.
For example:
for fore:
28.02.2014 18:08:30.841 ERROR [pool-6-thread-14-com/zz/zz/replication/job/webserver1(com/zz/zz/replication/job/webserver1)]

I would like to group on [pool-6-thread-14-com/zz/zz/replication/job/webserver1(com/zz/zz/replication/job/webserver1)]with a count of occurrences. Like a group by in a relational database.
thanks

[MuS]

Hi toby53,

First create a field extraction and use this field to group/stats on it. Assuming all your evnts for this new field starts with [ and ends with ] you can do something like this:

.... | rex "\s\[(?<myField>.*)\]" | stats count by myField

Hope this helps ...

Cheers, MuS

[MuS]

You're welcome, please accept the answer in this case thanks

[toby53]

thanks - works great ! We get thousands of log messages.