I have tried this
source=/var/log/testlog "EXP" OR "Q up" OR "X listing" | rex "(?<myword>EXP|Q up|X listing)" | stats count by myword
But I get the result
Myword Count
EXP 23
X listing 55
How do I get all the three results? And also get a pie chart or it?
//Chappe4
Thanks the solution did work.
Awesome. Could you please mark my answer as accepted? Thanks!
If you're not seeing "Q up" in your stats table, that's either because it wasn't found in any of the events, or more likely because the events with the text "Q up" also contains one or more of the other values in your regex. By default rex
will only match one time per event, so if you have an event with this text:
blabla EXP blabla Q up blablabla
rex
will only extract "EXP" into your myword
field. To have it match more than once, use the argument max_match
which controls how many times rex
is allowed to match within an event (default is, obviously, 1).
So for instance to allow rex
to match 3 times, your search would be modified like this:
source=/var/log/testlog "EXP" OR "Q up" OR "X listing" | rex max_match=3 "(?<myword>EXP|Q up|X listing)" | stats count by myword
This should yield the results you're looking for. To get a pie chart of it, if you're in the search app, click the "Build report" link to the right, choose "pie" as the chart type and apply.
This work for me.
Thank you very much!