how to extract total count for different fields

[wkau]

Hi, i will like to extract the count for the following

Data_no: 1T    
Identity: A  
Data_no: 2T  
Identity: C

i tried the following

| rex max_match= 0 "(?m) Data_no: (?<DataNo>[a-zA-Z0-9#]+)"  
| rex max_match= 0 "(?m) Identity: (?<Identity>[a-zA-Z0-9#]+)"   
| stats count(eval(Identity= "A")) as A, count(eval(Identity= "C")) as C by DataNo

The table returns the following:

DataNO| A | C  
1T    | 1 | 1  
2T    | 1 | 1

How to i filter it so that it will become like this:

DataNO| A | C  
1T    | 1 | 0  
2T    | 0 | 1

Thanks for your help!

[somesoni2]

Try this

Updated

your base search| rex max_match= 0 "(?m) Data_no: (?<DataNo>[a-zA-Z0-9#]+)"  
| rex max_match= 0 "(?m) Identity: (?<Identity>[a-zA-Z0-9#]+)" | eval temp=mvzip (DataNo, Identity) | mvexpand temp | rex field=temp "(?<DataNo>.*) (?<Identity>.*)"
| chart count over DataNo by Identity

[somesoni2]

Try updated answer.

[wkau]

I still got back the same results the data that is provided happens in the same event at the same time, is it possible to filter the DataNO and Identity individually so that it does not double count?

[wkau]

after trying that i got A=1, C=1 for 1T and A=1, C=1 for 2T. i will need something like A=1,C=0 for 1T and A=0, C=1 for 2T

[strive]

try this
|chart count by datano identity

[wkau]

yup this is an example of how my data is!

[strive]

Data_no: 1T
Identity: A
Data_no: 2T
Identity: C

This is how your data is? If answer is no then can you post some sample log lines.