Dynamic Grouping

Hi !

We have a big index, with lot of informations,

Informations sample :

2020-09-01T04:25:18.357Z|LogLevel=Info |MyBusiness.MyLogger|CorrelationId="0000000000000000000"|10.10.10.10|
POST test/order 1001|InputParameter - Request send to [MYPROJECT] - Unknown Switch Parameter Name [PARAMS1, PARAMS2, PARAMS3, PARAMS4, ...]

What we want to do :

Dynamic aggregation on [PARAMS1, PARAMS2, PARAMS3, PARAMS4, ...]

Sample :

PARAMS1 : 1247 count
PARAMS2 : 471 count
PARAMS3 : 871 count
...

It's possible with Kibana ?

Kind regards,

I don't fully understand your question. Is PARAM a field in your index with valyes PARAMS1, PARAMS2, PARAMS3 ?

what do you mean by dynamic aggregation ?

if you have a field X with values x, y, z .... you could do a term aggregation on field X and that will produce a result like you mention: every row is gonna represent one of the possible values (with the one with highest count showing fisst) and second column is gonna be the count.

Hello,

Thank for reponse,
PARAMS1, PARAMS2, PARAMS3 => Is string value in raw_message.

that won't be possible then. you will need to reindex your data and extract those into a separate field.

Hello,

Thank's for response, just after the query we use before in Splunk :

env:int AND source:my-project AND "Request send to" AND logger:"My.Project.MyLogger" | rex "Unknown Parameter Name /[(?<params>[a-zA-Z,]*)\]"