index=abc source=license_usage.log type=usage | rex field=h "(ab2)(?P\w+[^\d+])" |search Group=kb01m OR Group=kb02r | eval GB = b/1024/1024 | rename s AS source | stats sum(GB) AS "MB consumed" by Group
Above is the query ,but we have different groups like kb02m,kb02r,kb03m,kb03r,kb04m,kb04r......kb500m . How can i modify my query to find which group is consuming more MB . i would like have output of top 50 contributing group names along with MB they consumed.
index=abc source=license_usage.log type=usage | rex field=h "(ab2)(?P\w+[^\d+])" |search Group=kb01m OR Group=kb02r | eval GB = b/1024/1024 | rename s AS source | stats sum(GB) AS "MB consumed" by Group|sort 0 Group - "MB consumed" |streamstats count by Group|search count<=50|fields - count
something like this, maybe?
Like this:
index=abc source=license_usage.log type=usage
| rex field=h "(ab2)(?<Group>\w+[^\d+])"
| regex Group="YourRegExForGroupsToConsiderHere"
| top limit=50 useother=f Group BY b
thanks for the reply. But i am trying to make the group name dynamic because it is difficult to mention all the 500 groups . something like | Group=kb(\d)m OR Group=kb(\d)r
and it should list the top 50 groups .
I have updated my answer to include all requirements.