I have the following result from a simple query:
184.168.152.54 10.10.42.61 - - [09/Oct/2013:09:14:38 -0500] "GET /tgg/api2.php?KeyID=k207238&mode=xml&i=9780486472515 HTTP/1.1" 200 23 "-" "-" 0
How can I get the unique values of KeyID and their count?
Hello
Try this:
sourcetype="yoursourcetype" | rex "KeyID=(?<KeyID>\w+)\&" | stats count by KeyID
Regards
Hello
Try this:
sourcetype="yoursourcetype" | rex "KeyID=(?<KeyID>\w+)\&" | stats count by KeyID
Regards
Try
yoursearch | stats count by KeyID