I need to add something to the following search string (or rewrite it) that captures the following;
This search string
host="192.168.105.25" Prism http://DCSPRSAPPTS01.chpnet.org:80//Citrix/MetaFrame action="POST"| stats count by user, dest_url
Generates the following results
user dest_url Count
phtwe http://DCSPRSAPPTS01.chpnet.org:80//Citrix/MetaFrame/auth/login.aspx 99
nkhan http://DCSPRSAPPTS01.chpnet.org:80//Citrix/MetaFrame/auth/login.aspx 83
Do you just want the equivalent of:
... | bucket _time span=1d | stats count by _time,user,dest_url
Seems to me that's it. If you want the total for each URL, you can get it by adding:
... | eventstats sum(count) as total_count by _time,dest_url
or there is a trick you can do by creating a multivalued field:
... | eval user=user+";"+"*" | eval user=split(user,";") | bucket _time span=1d | stats count by _time,user,dest_url
which will put the total count as the *
user. You can use any value besides *
if it doesn't conflict with a real user name.
Note: I just improved the formatting of the question so its more readable now.
Still not sure what your are really asking here, but perhaps the following question/answer would be helpful to you. You both seem to be looking at Citrix/MetaFrame POST events:
I'm still confused. I think you should supply some sample events and clarify exactly what you need to do functionally.
By "string", do you mean "search string"? Can you provide a sample event or two. I assume your are looking at some kind of http access log? Is this correct? (Please edit your question and provide some additional details.)
Can you clarify what you want to get the sum of?