I have following logs where field4 is coming twice in each log line.
Example:
2018-04-06T23:01:36.264+0000 logLevel=INFO Response=(( filed1=XXX, field2=ZZZZ), field3=jeSession, field4=abc_xxx, field6=ddd.com, field6=)) field7=service1 field4=xyz_xxx field8=ser1
2018-04-06T23:01:36.264+0000 logLevel=INFO Response=(( filed1=YYY, field2=ZZZZ1), field3=tuSession, field4=abc_yyy, field6=ccc.com, field6=)) field7=service2 field4=xyz_yyy field8=ser2
How I can make sure it always pick first field4 for value (one with value as "acd_xxx", "abc_yyy"). I tried using mvindex but it works with multiple value in field itself (e.g. field4=xxx,yyy)
I want to display count by first field4 only
index=XXXXX | eval res=mvindex(field4,0) | stats count by res
... View more