How to get word freqency?
Say I have a string in each log line and I want to find the word frequency across log lines of a certain period. How would I go about that?
-
Hi Greg,
You will want to parse the string from the message and then you can perform a subsequent parse to parse each word from that string. (using a parse regex along with the "multi" option) Once you have the words parsed you can use one of the count operations on the field to get your counts of each word.
Your basic query would be the following.| parse "title = \"*\"" as title
| parse regex field=title "(?<word>\w+)" multi
| count_frequent wordMore help on the parse regex operation can be found in the following help documentation.
https://help.sumologic.com/Search/Search-Query-Language/01-Parse-Operators/02-Parse-Variable-Patterns-Using-RegexMore help on the count operations can be found in the following help documentation.
Please sign in to leave a comment.
Comments
2 comments