Get the count or number of occurences of the event values

[splunknovice201]

I have this search
index="jobs" host="abcp11" source="/work/grid_jobdir*.nodeFile" | rex field=source "(?i)/grid_jobdir/(?P\w+)" | search JOBNAME="*"

And below are the results:
11/1/13
11:04:51.000 AM etlax1101 etlax1104 etlax1105 etlax1106 JOBNAME=WMSLockCode

11/1/13
10:50:19.000 AM etlax1106 etlax1107 JOBNAME=CIFAbapExtrIdocsStatus30JB

I want to count the number of occurences for each etlax***:
etlax1101 1
etlax1104 1
etlax1105 1
etlax1106 2
etlax1107 1

I used this search but it's not working:
index="jobs" host="abcp11" source="/work/grid_jobdir*.nodeFile" | rex field=_raw "(?P\w+)" | mvexpand RESOURCENODE | stats count by RESOURCENODE

Help please?

Thanks.

[somesoni2]

This could be a possible workaround: Extending your query, in which JOBNAME field is already extracted :

index="jobs" host="abcp11" source="/work/grid_jobdir.nodeFile" | rex field=source "(?i)/grid_jobdir/(?P<jobname>w+)" | search JOBNAME="" | rex field=_raw "(?:[^ \n]* ){3} (?P<F1>.+)"| eval F2=replace(F1," JOBNAME="+JOBNAME,"")| table F2|eval F2=split(F2," ") | mvexpand F2 | stats count by F2

[dmaislin_splunk]

Ummmm. You created a field called resourcenode but you did not use that in the remainder of the search. You used all CAPS RESOURCENODE.

[splunknovice201]

Hi, thanks! I have RESOURCENODE in caps now. I'm not getting the expected output yet.