I am dealing with cloudwatch logs, and I have a situation where I need to list all the words from the logs in order of their frequency. I have tried the following queries, but they haven't worked. If you could help, that would be greatly appreciated.
Query1:
fields @message
| parse @message /(?\<word\>\[^\\s\]+)/
| stats count() by word
| sort count() desc
Query2:
fields @message
| split " "
| stats count(*) by \*
| sort count\_* desc
list of all the terms from the cloud watch logs listed in frequency order