I have the following data:
10..20.10.100 - - [11Nov/2011:13:21:16 -0500] "GET /portlets/market_info.json?ID_STUFF=32497,32498,32104,891848,1244022,2474811 HTTP/1.1" 200 3281 "-" "Jakarta Commons-HttpClient/3.1"0/920549
I am creating the "ID_VALUES" field with the following search
index=test ID_STUFF | rex max_match field=_raw "ID_STUFF\=(|\S+,)(?<ID_VALUES>.*?)(\s+|&)"
The ID_VALUES field is now a multi-value field. I want to extract each value and run additional search commands against it. I have tried the following and it is not working:
index=test ID_STUFF | rex max_match field=_raw "ID_STUFF\=(|\S+,)(?<ID_VALUES>.*?)(\s+|&)" | mvexpand ID_VALUES | stats count by ID_VALUES
This is not giving me an individual count of each value of the multi-value field of ID_VALUES. My results look like this:
ID_VALUES Count
32497,32498,32104,891848,1244022,2474811 2
I want it to look like the following:
ID_VALUES Count
32497 2
32498 2
32104 2
891848 2
1244022 2
2474811 2
What is the correct multi-value field search command to pull this together?
Give this a try:
index=test ID_STUFF | rex max_match field=_raw "ID_STUFF\=(|\S+,)(?<ID_VALUES>.*?)(\s+|&)" | makemv delim="," ID_VALUES | mvexpand ID_VALUES | stats count by ID_VALUES
Hope this helps.
> please upvote and accept answer if you find it useful - thanks!
index=test ID_STUFF | rex max_match field=_raw "ID_STUFF=(|\S+,)(?.*?)(\s+|&)" | eval ID_VALUES =split(ID_VALUES ,",") | mvexpand ID_VALUES | stats count by ID_VALUES
That was the ticket. I forgot about combining the makemv and mvexpand.
Give this a try:
index=test ID_STUFF | rex max_match field=_raw "ID_STUFF\=(|\S+,)(?<ID_VALUES>.*?)(\s+|&)" | makemv delim="," ID_VALUES | mvexpand ID_VALUES | stats count by ID_VALUES
Hope this helps.
> please upvote and accept answer if you find it useful - thanks!
Actually, you don't need mvexpand at all, and your search will be more efficient without it. Also, I personally would replace | makemv delim=",",ID_VALUES
with | eval ID_VALUES=split(ID_VALUES,",""
.