Hi, need some help in crafting a search query that could get count by a regex and display counts in a table.
The log msg we have is "Successfully submitted: admin-mobile" or "Successfully submitted: admin". I'd like to count numbers of msg contains "admin-mobile" and "admin" respectively and show them in a table.
I know that I can get one count by:
`| search "Successfully submitted: admin-mobile" | stats count` and it will show in a table.
Question is how to get the other count. Thanks.
The result i'd like to have is like below, in a table format:
submissionType count
admin-mobile 999
admin 888
Use
your_search... "Successfully submitted: admin*"
| rex "Successfully submitted: (?<user>[\w-]+)"
| stats count by user
your rex regex will be dependent on what you want to extract and what may follow user name, but the above will take user from the words following the Successfully submitted message.