Solution Summary
- Observed that there was a multiline pattern issue; due to which majority of the Message field where storing junk values; grok used to fail for these patterns and only few genuine patterns were only getting parsed and therefore, count was mismatching. Fixing the multiline pattern issue resolved this issue.
- Added field TxnType with value NA wherever this field is missing; by this our Txn count will match.
|
Solution Steps in Detail
- There was a multiline pattern issue; due to which the majority of the Message field where storing junk values; grok used to fail for these patterns and only few genuine patterns were only getting parsed and therefore, count was mismatching. Fixing the multiline pattern issue resolved this issue.

Commented part in the screenshot after grok is an older pattern.
- Added field TxnType with value NA wherever this field is missing; by this our Txn count will match.

Whatever null TxnCategory occurs that will be counted as NA.
Final Result:

|