Display count of log content with content message and time

[Shal]

Hi Team,

Can I get a query (DQL) that can display the results in the below manner for a particular log file 

example: D:/logs/log.txt

I need different content and its count based on date or time selection.

content	count	date/time
error: abc	2	5th may
error:def	3	5th may
error: ghi	1	6th may

Thanks!

[p_devulapalli]

@Shal Here is an example query you can try

fetch logs
| fieldsAdd day = getDayOfMonth(timestamp), month = getMonth(timestamp)
| filter log.source == "D:/logs/logs.txt"
| summarize count = count(), by: { day, month, content }

[Shal]

Hi @p_devulapalli 

Thanks for the input.

Its showing the content, count ,day and month.

If you see the below snip, the red ones are same content and blue ones are same content. So can we sum it for a day so that it will show 2 contents with count as 4 each in this case.

Here it is showing separate count as there is small difference in microsecond 

Thanks

[p_devulapalli · Accepted solution]

@Shal that's because of the timestamp in the content, you just need to find a way to clean/split up the content and them summarize to get the expected result