|tstats count where index=app-data (TERM(Errors) TERM( Started) TERM( in) TERM(*s) TERM(*ms)) OR (TERM(system) TERM(restart))
when i run the above query i am getting overall(combined) results. but i want to see the results for each and every string separately which i mentioned in the query.
how can i do that????
You can't do that. Splunk doesn't keep track of which part of the condition was matched on a particular result line. And you can only split your aggregation on a field or prefixed value.
Ok if that is a case we can do without tstats using eval command
May I know how can I do that
I don't quite follow, to be honest.
Of course you could go through a list of terms to match over event by event and set a field in case it matched but it will be way way way worse performance-wise.