below is the data which has multiple features for a single item. I want to write a regex which could search all occurrences of feature (not just first occurance) and then count the feature . I have written below search string but count value is not consistent. can someone plz take a look and advice.
Many thanks in advance.
|makeresults | eval _raw="[{\"\"feature\"\": \"\"INTDATA\"\"}, {\"\"feature\"\": \"\"INTDATA2\"\"}, {\"\"feature\"\": \"\"MGDAT0\"\"}, {\"\"feature\"\": \"\"MGPR2TI\"\"}, {\"\"feature\"\": \"\"MSTORE\"\"}, {\"\"feature\"\": \"\"PNINCLWAP\"\"}, {\"\"feature\"\": \"\"PRMCAFIND\"\"}, {\"\"feature\"\": \"\"3WY\"\"}, {\"\"feature\"\": \"\"CFC\"\"}, {\"\"feature\"\": \"\"CFU\"\"}, {\"\"feature\"\": \"\"CLIP\"\"}, {\"\"feature\"\": \"\"CLIR\"\"}, {\"\"feature\"\": \"\"CLW\"\"}, {\"\"feature\"\": \"\"DATA\"\"}, {\"\"feature\"\": \"\"CAMTAC\"\"}, {\"\"feature\"\": \"\"HOLD\"\"}, {\"\"feature\"\": \"\"INROAM\"\"}, {\"\"feature\"\": \"\"ISP\"\"}, {\"\"feature\"\": \"\"MSTORE\"\"}, {\"\"feature\"\": \"\"NWROAM\"\"}, {\"\"feature\"\": \"\"PERMGL\"\"}, {\"\"feature\"\": \"\"SMSO\"\"}, {\"\"feature\"\": \"\"VM\"\"}, {\"\"feature\"\": \"\"GFLEX\"\"}]" |rex max_match=0 "\"\"feature\"\": \"\"(?<feature>.*?)\"\"}" |stats count(feature) by feature
... View more