fields @timestamp, @message
| filter @message like /Digest/
| parse @message /Digest: "(?<digest>.*)"/
| stats count() as occurrences by digest
| sort occurrences desc
Counts distinct digest matches.
fields @timestamp, @message
| filter @message like /Digest/
| parse @message /Digest: "(?<digest>.*)"/
| stats count() as occurrences by digest
| sort occurrences desc
Counts distinct digest matches.