Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to count the results of a rex that returns multiple matches as a single group of matches?

$
0
0
I have results from a rex statement that looks something like the first set of results. The rex returns multiple matches per row. I am trying to use the *stats* function to group multiple matches as a single group (see ***Desired***). However, my *stats* statement currently sees each match as a separate group (see ***Not Desired***). Is there a way to return the ***Desired*** result? ***Multi-match rex results*** **namespace** ......................................................... System.ServiceModel.Channels System.ServiceModel.Dispatcher .......................................................... System.ServiceModel.Channels System.ServiceModel.Dispatcher .......................................................... ***Statement*** ... |stats count by namespace ***Desired*** **namespace** **count** ......................................................................................... System.ServiceModel.Channels 2 System.ServiceModel.Dispatcher ......................................................................................... ***Not Desired*** **namespace** **count** ......................................................................................... System.ServiceModel.Channels 1 System.ServiceModel.Dispatcher 1 .........................................................................................

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>