I would like to show results group by "SLA Request Key". I am able to view sample Data-2 but not Sample Data-1
Sample Data-1:
{"key":"SLA Request Key","value":"mls.ILSP_CONTNR_SKU_INSERT"}]}
Sample Data-2:
{"key":"SLA Request Key","value":"GetPickGroupsByBinLocation"}]}
index = xyz "Database Call Exceeded SLA" | rex field=_raw "SLA Request Key\",\"value\":\"(?\\w+)\"}]}" | stats count by slaKey
when i run this search, i am only getting the results for Sample Data-2(GetPickGroupsByBinLocation) not "mls.ILSP_CONTNR_SKU_INSERT" this. I assume this is not parsing stats count by when value is combined with Dot and Underscore
Can any one please help me?
Thanks in Advance!
Your regex string is only looking for word characters (letters, numbers, and underscores) so periods don't match. Try
... | rex "SLA Request Key\",\"value\":\"(?<field>[\.\w]+)\"}]}" | ...
Since you are having json, why don't you use spath in your search? I would suggest put the extraction in the props.conf. Any how answering your question, try...
your base search | spath | stats c by key
Sample search ..
|stats c | eval _raw="{\"key\":\"SLA Request Key\",\"value\":\"mls.ILSP_CONTNR_SKU_INSERT\"}]}" | append [|stats c | eval _raw="{\"key\":\"SLA Request Key\",\"value\":\"GetPickGroupsByBinLocation\"}]}" ] | spath | stats c by key
Thank you so much for your reply.
But your solution is not the one exactly which i am looking for.
Though this will be incredibly useful for me in future.
Thanks again for your valuable response.
If you can give me solution for your reply
"your base search | spath | stats c by key"
There are many keys in my raw data i was looking for key "SLA Request Key" and i want to exclude remaining keys and i want stats count by key
something like this
"my Base search ""SLA Request Key"" | spath | stats c by key -remove key2, key3 .........keyn"
Your regex string is only looking for word characters (letters, numbers, and underscores) so periods don't match. Try
... | rex "SLA Request Key\",\"value\":\"(?<field>[\.\w]+)\"}]}" | ...
Thank you so much it worked for me !