spath "log.message" | search "log.message"="REQ_TRACK_ID_MISSING*" OR "log.message" ="DESERIALIZATION_EXCEPTION*" OR "log.message" = "SERIALIZATION_EXCEPTION*".
Then from the results, I want to trim the asterisk part of string and print a table with count eg.
log.message | count |
REQ_TRACK_ID_MISSING | 10 |
DESERIALIZATION_EXCEPTION | 12 |
SERIALIZATION_EXCEPTION | 5 |
I tried so many functions including replace, trim.. but I'm not able to formulate the results as shown above. How can we achieve this?
I usually do that using a case expression.
spath "log.message"
| search "log.message"="REQ_TRACK_ID_MISSING*" OR "log.message" ="DESERIALIZATION_EXCEPTION*" OR "log.message" = "SERIALIZATION_EXCEPTION*"
| eval logMessage = case(match("log.message","REQ_TRACK_ID_MISSING.*"), "REQ_TRACK_ID_MISSING", match("log.message", "DESERIALIZATION_EXCEPTION.*"), "DESERIALIZATION_EXCEPTION", match("log.message", "SERIALIZATION_EXCEPTION.*"), "SERIALIZATION_EXCEPTION", 1=1, "log.message")