Hi,
I have extracted 2 fields i.e. field1 & field2, while using the stats count command how do i use these extracted fields so that they show up in same table like below
source issue _time
userx field1 12:00
usery field1 13:00
userz field2 14:00
Or should i use 2 different tables for field1 and field2
below are the searches i am using
index=test1 | rex field=source "\\\\(?<source>\w+)-(?<issue>\w+)\.log$" | stats count by source,_time,field1| sort -_time| fields source,_time,field1
index=test1 | rex field=source "\\\\(?<source>\w+)-(?<issue>\w+)\.log$" | stats count by source,_time,field2 | sort -_time| fields source,_time,field2
Sorry, i phrased the table wrong. field 1 and field2 are does not fall under issue
below is how i need the table,
source Notification _time
userx field1 12:00
usery field1 13:00
userz field2 14:00
Then you can append 2nd query results to first one:
index=test1 | rex field=source "\\\\(?<source>\w+)-(?<issue>\w+)\.log$" | stats count by source,_time,field1| sort -_time| fields source,_time,field1 | eval Notification="field1" | append [ search index=test1 | rex field=source "\\\\(?<source>\w+)-(?<issue>\w+)\.log$" | stats count by source,_time,field1 | sort -_time| fields source,_time,field2 | eval Notification="field2"] | fields Notification, source, _time| stats max(source) as source, max(_time) as _time by Notification
hi @SS1,
If field1 and field2 are values of field issue, then you only need one query:
index=test1 | rex field=source "\\\\(?<source>\w+)-(?<issue>\w+)\.log$" | stats count by source,issue,_time | fields -count