topic Re: Display count of log content with content message and time in Log Analytics

Display count of log content with content message and time

Shal — Fri, 09 May 2025 14:54:35 GMT

Hi Team,

Can I get a query (DQL) that can display the results in the below manner for a particular log file

example: D:/logs/log.txt

I need different content and its count based on date or time selection.

content	count	date/time
error: abc	2	5th may
error:def	3	5th may
error: ghi	1	6th may

Thanks!

Re: Display count of log content with content message and time

p_devulapalli — Mon, 12 May 2025 00:46:38 GMT

@Shal Here is an example query you can try

fetch logs | fieldsAdd day = getDayOfMonth(timestamp), month = getMonth(timestamp) | filter log.source == "D:/logs/logs.txt" | summarize count = count(), by: { day, month, content }

Re: Display count of log content with content message and time

Shal — Thu, 26 Jun 2025 13:17:23 GMT

Hi @p_devulapalli

Thanks for the input.

Its showing the content, count ,day and month.

If you see the below snip, the red ones are same content and blue ones are same content. So can we sum it for a day so that it will show 2 contents with count as 4 each in this case.

Here it is showing separate count as there is small difference in microsecond

Thanks

Re: Display count of log content with content message and time

p_devulapalli — Mon, 12 May 2025 06:59:03 GMT

@Shal that's because of the timestamp in the content, you just need to find a way to clean/split up the content and them summarize to get the expected result