Try something like this
index=ax "Student enrolled " OR "student graduated " "sId: 1001" | eval EnrolledStudents=if(searchmatch("Student enrolled "),1,0) | eval GraduatedStudents=abs(1-EnrolledStudents) | table EnrolledStudents, GraduatedStudents | stats sum(*) as *
If this doesn't work, try this
index=ax "Student enrolled " OR "student graduated " | rex "sId=(?<sId>[0-9]+)" | where sId=1001 | eval EnrolledStudents=if(searchmatch("Student enrolled "),1,0) | eval GraduatedStudents=abs(1-EnrolledStudents) | table EnrolledStudents, GraduatedStudents | stats sum(*) as *
... View more