@richgalloway so combining your responses, something like this?
| eval appType = case(SourceName="Foo \"bar(\"", "app1",
SourceName="Foo \"quill(\"", "app2",
SourceName="Foo", "app3",
source...
See more...
@richgalloway so combining your responses, something like this?
| eval appType = case(SourceName="Foo \"bar(\"", "app1",
SourceName="Foo \"quill(\"", "app2",
SourceName="Foo", "app3",
source=abcde, "app4",
sourcetype=windows AND eventcode=11111, "app5",
1==1, "other")
| stats count by appType
| append [ makeresults format=csv data="app_name,error_count
app1,0
app2,0
app3,0
app4,0
app5,0"]
| stats sum(error_count) as error_count by app_name