Splunk breakdown results by matched search phrase

Question

I'm searching for a few different search terms, and I would like stats grouped by which term matched:

"PhraseA" "PhraseB" "PhraseC" | timechart count by <which Phrase matched>

What should be in place of <which Phrase matched>? I will be building a stacked bar chart with the results.

Answer 1

try creating a category field using eval and case, and using that in your chart:

index=whatever_index "PhraseA" "PhraseB" "PhraseC"
| eval matched_phrase=case(searchmatch("PhraseA"), "PhraseA", searchmatch("PhraseB"), "PhraseB", searchmatch("PhraseC"), "PhraseC")
| timechart count by matched_phrase

Lots more good info in the Splunk documentation for these functions