Hi, i will like to extract the count for the following
Data_no: 1T
Identity: A
Data_no: 2T
Identity: C
i tried the following
| rex max_match= 0 "(?m) Data_no: (?<DataNo>[a-zA-Z0-9#]+)"
| rex max_match= 0 "(?m) Identity: (?<Identity>[a-zA-Z0-9#]+)"
| stats count(eval(Identity= "A")) as A, count(eval(Identity= "C")) as C by DataNo
The table returns the following:
DataNO| A | C
1T | 1 | 1
2T | 1 | 1
How to i filter it so that it will become like this:
DataNO| A | C
1T | 1 | 0
2T | 0 | 1
Thanks for your help!
Try this
Updated
your base search| rex max_match= 0 "(?m) Data_no: (?<DataNo>[a-zA-Z0-9#]+)"
| rex max_match= 0 "(?m) Identity: (?<Identity>[a-zA-Z0-9#]+)" | eval temp=mvzip (DataNo, Identity) | mvexpand temp | rex field=temp "(?<DataNo>.*) (?<Identity>.*)"
| chart count over DataNo by Identity
Try updated answer.
I still got back the same results the data that is provided happens in the same event at the same time, is it possible to filter the DataNO and Identity individually so that it does not double count?
after trying that i got A=1, C=1 for 1T and A=1, C=1 for 2T. i will need something like A=1,C=0 for 1T and A=0, C=1 for 2T
try this
|chart count by datano identity
yup this is an example of how my data is!
Data_no: 1T
Identity: A
Data_no: 2T
Identity: C
This is how your data is? If answer is no then can you post some sample log lines.