0

I'd like to get the total distinct count of each message in log groups. The format of the message is: Total of [n] rows have been loaded to [table_name]

example message: @message

  • Total of 1234 rows have been loaded to table1
  • Total of 14 rows have been loaded to table3
  • Total of 345 rows have been loaded to table2
  • Total of 864 rows have been loaded to table3

and my expected output would be 3 instead of 4. How can I execute this on my query?

JamesBowery
  • 71
  • 10

1 Answers1

0
fields @message
| parse "Table of * rows have been loaded to *" as rows, table_index
| stats count_distinct(table_index)

You might have to filter/parse little differently, but this is the general idea.

Nikhil Krishna
  • 1
  • 1