Search mutiple strings in logs and give count of respective string

[ma_anand1984]

This is a followup question to

http://splunk-base.splunk.com/answers/61123/how-can-i-search-in-logs-for-mutiple-vaules-from-a-file

I learnt from above post that below is the query to search for mutiple strings.

source=snmp [|inputlookup severity | fields sev | rename sev as search | format]

Now, say if "foo", "bar", "blah" are present one per line in the lookup file "severity" under field "sev"

I want output like below

String    Count

foo         5

bar         0 

blah        3

How can we achieve that ?

[jameshgibson · Accepted solution]

If I understand you correctly I did this in a rather inelegant way.

[your search] | rex field=sev "(?< f>foo)" | rex field=sev "(?<b>bar)" | rex field=sev "(?< bl>blah)" | eval strings=mvappend(f,NULL,b) | eval strings=mvappend(strings,NULL,bl) | mvexpand strings | stats count by strings

remove the spaces from the group names had to add them in to get it formating correctly. Hopefully someone can come up with something less awkward.