how to get the number of occurrences of a term in a message

Follow

Adam Himmelman

• November 08, 2016 19:56

how can you get the number of occurrences of a specific term in a message?. a message that looks like "the fox jumped over the fence because he saw the rabbit while he was hungry" would return 3 for searching "the" and return 2 when searching "he" i tried to split the message by my term but could not find a way to get the length of the split result and parse multi to no avail. any pointers in the right direction would be greatly appreciated.

1

• 

  Brenton Carbins

  • January 18, 2017 09:05

  //This search will count the number of times 'exception' appears in messages in the query scope: _sourceCategory=*| 1 as Increment | accum Increment as MessageNo // ie: MessageNo+=1| extract field=logmessage "(?[a-zA-Z][a-zA-Z0-9]+)" multi //split by word | where word matches "exception" //retain only matching| count by MessageNo // Uncomment to include message , _raw

  -2

  Comment actions Permalink

Please sign in to leave a comment.