Yes, you can if it has been extracted. I gave an example for the situation where it hadn't been extracted. ... View more

Try index="stage*" source="*record service*" | eval type=case(like(message, "%successful generated account%"),"Success Accounts", like(message, "%Granting failed Accounts%"),"Granting failed Accounts", like(message, "%Inbound setup failed accounts%"),"Inbound failed Accounts") |stats count as Results by type |append [|stats count as Results|eval type="Success Accounts,Granting failed Accounts,Inbound failed Accounts"|makemv type delim=","|mvexpand type] |stats sum(Results) by type   ... View more