how to get the number of occurrences of a term in a message

Comments

1 comment

  • Avatar
    Brenton Carbins
    //This search will count the number of times 'exception' appears in messages in the query scope: _sourceCategory=*| 1 as Increment | accum Increment as MessageNo // ie: MessageNo+=1| extract field=logmessage "(?[a-zA-Z][a-zA-Z0-9]+)" multi //split by word | where word matches "exception" //retain only matching| count by MessageNo // Uncomment to include message , _raw
    -2
    Comment actions Permalink

Please sign in to leave a comment.