Hi,
I am looking to filter out the contents of Search results that is using rex, transpose and count.
we are having multiple results with count 0 and need to be removed from report as its occupying majority of dashboard.
Below is Command sample:
table "_raw" | rex field=_raw "(?PCode1)" | rex field=_raw "(?PCode2)" | rex field=_raw " (?PCode3) " | stats count(eval(match(AA,""))) AS "Message1", count(eval(match(AB,".*"))) AS "Message2" , count(eval(match(AC,".*"))) AS "Message3" |transpose
i am not sure how i can filter out this as where count>0 is not working.
Firstly, to ensure the whole search/code/result that you add in your question is completely shown, you should select the query/code/result part and press Ctrl +K OR click on "101 100" button on top of the text box.
Please ensure that you confirm the rex portions and try this.
...your base search | table "_raw" | rex field=_raw "(?P<AA>Code1)" | rex field=_raw "(?P<AB>Code2)" | rex field=_raw " (?P<AC>Code3) " | stats count(eval(match(AA,""))) AS "Message1", count(eval(match(AB,"."))) AS "Message2" , count(eval(match(AC,"."))) AS "Message3" | eval temp=1 | untable temp Message Count | where count>0 | fields - temp
If an event only contains one Code (a row will have only one of AA, AB or AC, then try this version
...your base search | table "_raw" | rex field=_raw "(?P<Message>(Code1|Code2|Code3))" | stats count by Message | where count>0
The Code 1 to Code 3 and Message1 to message3 are just aliases as it cannot be shared, but they hold different values and there is no string with Message in them.
when I tried adding eval temp=1 | untable temp Message Count | where count>0 | fields - temp, it didn't work.