How can I do a group by on a log column.
For example:
for fore:
28.02.2014 18:08:30.841 ERROR [pool-6-thread-14-com/zz/zz/replication/job/webserver1(com/zz/zz/replication/job/webserver1)]
I would like to group on [pool-6-thread-14-com/zz/zz/replication/job/webserver1(com/zz/zz/replication/job/webserver1)]with a count of occurrences. Like a group by in a relational database.
thanks
Hi toby53,
First create a field extraction and use this field to group/stats on it. Assuming all your evnts for this new field starts with [ and ends with ] you can do something like this:
.... | rex "\s\[(?<myField>.*)\]" | stats count by myField
Hope this helps ...
Cheers, MuS
You're welcome, please accept the answer in this case thanks
thanks - works great ! We get thousands of log messages.