I'd like to make a chart on how many times a state-text occurs. The thing is, there can be more than one state-text in one log line. At least there is one state-text ("state-text0":"xyz"), but it's possible to have up to 10 state-texts ("state-text9":"xyz") occuring in that field of a csv I extract before with regex ("TPIOUT").
Two sample lines:
...|{...","id":"13543","recipient0":"41790094703","state0":"0","state-text0":"Ok","recipient1":"41790034932","state1":"0","state-text1":"Ok","recipient2":"41790028491","state2":"4","state-text2":"invalid short id","recipient3":"41790045754","state3":"0","state-text3":"Ok"}|...
...|{...","id":"13544","recipient0":"417924524503","state0":"4","state-text0":"Error due sys fail","recipient1":"41792534932","state1":"0","state-text1":"Ok","recipient2":"41135135491","state2":"0","state-text2":"Ok"}|...
So I want to see a chart like this:
OK: 5
invalid short id: 1
Error due sys fail: 1
"state-text[0-9]" is independent of "state[0-9]"
I tried something like this, but it didn't return a chart with values:
... | regex _raw="(?i)^(?:[^|]|){50}(?P[^|])" | rex max_match=10 state-text\d":"(?\w+) | eval state_text='states' | chart count by state_text
Thanks in advance for your help!
... View more