Let's say I have logs that look like: date,USER=Joe,ACTION=Open,RESULT=Success
If there are four different types of actions and I want to count the total number of actions by user, I would write a search like:
sourcetype=test.log | stats count(eval(ACTION="Open")) AS Open, count(eval(ACTION="Close")) AS Close, count(eval(ACTION="Read")) AS Read, count(eval(ACTION="Write")) AS Write by DATE,USER | table DATE,USER,Read,Write,Open,Close
What if there are 50 different values for ACTION? Would I have to write a monsterous search string to catch them all or is it possible to count each unique ACTION and save the count in a field with the same name as the action?
Thx.
Craig
All stats command supports splitting up stats by values like this using the by
operator:
sourcetype=test.log | stats count by ACTION
I this particular case, they want ... | stats count by DATE,USER,ACTION
. chart
is also an option, but would require some eval
to combine and split DATE
and USER