Hi
I have an event which has something like
/getproxy..... size:1
/getproxy..... size:10
/getproxy..... size:0
Want to calculate the total count when the size!=0 and count when size=0
using a rex in the search to extract size value
| rex "size:(?<Size>\d+)"
Any help appreciated
try like :
...| rex "size:(?<Size>\d+)"|stats sum(eval(Size!=0)) as "total size!=0" sum(eval(Size=0)) as "total size=0"|...
or
for the number of time size!=0 and number of time size=0 try this:
...| rex "size:(?<Size>\d+)"|stats count(eval(Size!=0)) as "number of time size!=0" count(eval(Size=0)) as "number of time size=0"|...
try like :
...| rex "size:(?<Size>\d+)"|stats sum(eval(Size!=0)) as "total size!=0" sum(eval(Size=0)) as "total size=0"|...
or
for the number of time size!=0 and number of time size=0 try this:
...| rex "size:(?<Size>\d+)"|stats count(eval(Size!=0)) as "number of time size!=0" count(eval(Size=0)) as "number of time size=0"|...
Of if you're more comfortable leaving eval tasks to the eval command, more or less the same idea would look like:
...| rex "size:(?