So I want to get the stats count of two search terms in a search that looks like this:
index=myIndex "searchTermA" OR "searchTermB"
(these searches being strings to find certain applications under the index and they have no fields to search for them by nor are they similar enough for field extraction to work [individually field extracting these also proves to have a lot of issues as well]).
and what I wish I could do is this:
index=myIndex "searchTermA" OR "searchTermB" | stats (or chart/timechart) count("searchTermA") count("searchTermB")
to get the data I want.
However, I am aware this is not possible. Is there some way to use eval to give these search strings a name and use them for count?
I also cannot go into the .conf files and edit them.
Thanks!
You can something like this
index=myIndex "searchTermA" OR "searchTermB" | stats count(eval(searchmatch("searchTermA"))) as CountA count(eval(searchmatch("searchTermB"))) as CountB
You can something like this
index=myIndex "searchTermA" OR "searchTermB" | stats count(eval(searchmatch("searchTermA"))) as CountA count(eval(searchmatch("searchTermB"))) as CountB
You can run something like ... |eval count_field = case(searchmatch("searchtermA"), "A_class",searchmatch("searchtermB"),"B_class") | stats (or chart/timechart) count by count_field
. It should return the counts of both types of events.