Hey Guys, i have spent all day trying to do this:
So this search:
index=nexus RNA-IVS "login failed" | timechart count
provides me with
Its counting all results with the string "login failed".
NOW, what i need is it to do two string counts of different words so i get this result:
date count1 (login failed) count2 (passed)
mon 8 3
tue 5 2
wed 3 3
please assist 😞
index=nexus RNA-IVS "login failed" OR passed | eval status = if(match(_raw,"(?i)login failed"),"Login failed","Passed") | timechart count by status
If you want to do this for more fields, that is possible. You could have multiple
eval statements with different criteria. As long as you assign the appropriate value to
status, the above will work.
However, I think you should consider creating some eventtypes for your data. This would let you categorize the information in a number of ways. Let's say that you named your eventtypes
RNA_connection_started etc. Now your search would be very simple (and flexible):
index=nexus RNA-IVS eventtype=RNA* | timechart count by eventtype
And if in the future you create more
RNA* eventtypes, this search will automatically pick them up.