I’m trying to find logs where requestId value is equal to requestId value in another log Trying to find logs like this "This is log1 with requestId={}" where requestId is equal to the requestId in log2 ...  "This is log2 with requestId={}, reason={}" Tried this and its not working … index=index env=env "This is log 1" | rex "requestId=(?<request_id>[^,]+)" | search requestId="request_id" AND reason=failed  Am I able to join these essentially somehow? I want log 1, not log 2.      ... View more

I need a query that will tell me the count of a substring within a string like this ... "This is my [string]" and I need find the word and count of [string]. "This is my" is always the same but [string] is dynamic and can be many things, such as apple, banana etc. I need tabular data returned to look like  Word           Count apple          3 I tried this but doesnt seem to working  rex field=_raw ".*This is my (?<string>\d+).*" | stats count by string    ... View more