I have events like below
-a3bcd: Info1234x:NullValue
-a3bcd: Info1234x:NullValue
-b3bcd: Info1234x:NullValue2
-c3bcd: Info1234x:NullValue3
I managed to produce a table like these
ErrorInfo Count
a3bcd: Info1234x:NullValue 2
-b3bcd: Info1234x:NullValue2 1
-c3bcd: Info1234x:NullValue3 1
I would like to condense those events into one since they are all same kind of error just different paramter
so it would be like
ErrorInfo Count
Info1234x: 1
Thanks in advance
| eval ErrorInfo = mvindex(split(ErrorInfo, ":"),1)
It didt work