I have a parsed field and I need to count the number of times a given string appears within it. It seems relatively simple, but I've been searching through Sumo documentation and now I'm not sure this is even possible. Please help!
2 Answers
I have an idea for a hacky solution using replace() regex variant.
If inputField is your input field and you want to count the number of times is happens in the inputField, then
| "This is a very hacky solution which might get you in trouble" as inputField
| replace(inputField, /is/, "@") as matched
| replace(matched, /[^@]/, "") as skipTheRest
| length(skipTheRest) as finalCount
The solution assumes @ is not present in the input field.
Disclaimer: I am currently employed by Sumo Logic.
If I understand question correctly, we have a field A which we have parsed and now we want to match if it contains some string s. In that case, below can be appended to your query.
| if(A matches "*s*", 1, 0) as ct
| sum(ct)
Related