Phrase Frequency

Comments

1 comment

  • Avatar
    Kevin Keech

    Hi Matt,

    You could probably try a "parse regex" along with the "multi" option to parse out each occurrence of the string within an individual message. Then you can count on that field to get the full number of occurrences within all the messages in the timerange. Here is an example.

    | parse regex "(?<phrase>some phrase to count)" multi
    | count by phrase


    If you want to get a count of the occurances just within each distinct message you can add an additional field to the count operation to count by each "raw" message.

    | parse regex "(?<phrase>some phrase to count)" multi
    | count by phrase, _raw


    More info on the parse regex and the "multi" option can be found in the help here.

    0
    Comment actions Permalink

Please sign in to leave a comment.