sourcetype=cron | rex ".*:\d{2}\s(?<host_name>\S+)" | rex "]:\sfinished(?<info>.*)" | stats count by host_name, info
0 comments