I'd like to make a chart on how many times a state-text occurs. The thing is, there can be more than one state-text in one log line. At least there is one state-text ("state-text0":"xyz"), but it's possible to have up to 10 state-texts ("state-text9":"xyz") occuring in that field of a csv I extract before with regex ("TPIOUT").
Two sample lines:
...|{...","id":"13543","recipient0":"41790094703","state0":"0","state-text0":"Ok","recipient1":"41790034932","state1":"0","state-text1":"Ok","recipient2":"41790028491","state2":"4","state-text2":"invalid short id","recipient3":"41790045754","state3":"0","state-text3":"Ok"}|...
...|{...","id":"13544","recipient0":"417924524503","state0":"4","state-text0":"Error due sys fail","recipient1":"41792534932","state1":"0","state-text1":"Ok","recipient2":"41135135491","state2":"0","state-text2":"Ok"}|...
So I want to see a chart like this:
OK: 5
invalid short id: 1
Error due sys fail: 1
"state-text[0-9]" is independent of "state[0-9]"
I tried something like this, but it didn't return a chart with values:
... | regex _raw="(?i)^(?:[^|]|){50}(?P[^|])" | rex max_match=10 state-text\d":"(?\w+) | eval state_text='states' | chart count by state_text
Thanks in advance for your help!
Your chart command didn't chart any values because it only contained a single non-numeric value ("states"). I'm not sure what the regex command is supposed to do. The rex command looks OK, but needs to extract fields to be charted. Try this:
... | rex max_match=10 "state-text\d\":\"(?P<state_text>[]\w ]+)" | chart count by state_text
Your chart command didn't chart any values because it only contained a single non-numeric value ("states"). I'm not sure what the regex command is supposed to do. The rex command looks OK, but needs to extract fields to be charted. Try this:
... | rex max_match=10 "state-text\d\":\"(?P<state_text>[]\w ]+)" | chart count by state_text
Thank you very much for your help! I could make it work like that. With your explanation I also understand the way of how the rex works in this command.
The regex before gave only the content of that field to the next pipe