How to develop a line chart that counts each subdirectory in the URL?

[jandresaedo]

Hello Guys,
I have 3 different directory in the same URL, for example:

1. https://anydns.com:443/event/anyother.xml
2. https://anydns.com:443/cupcake/any.json
3. https://anydns.com:443/something/any.xml

So I want count every sub-directory in the URL, and I tried with the following search:

index=some_index url="https://anydns.com:443/*/" | timechart count(url) by url

But my line chart or the statistics in the Eje x splits into every URL and I want to see 1 graph with statistics about how much picks had one URL in some time.

Thank you and sorry for my bad english.

[gokadroid · Accepted solution]

There might be many ways but how about trying something like this :

your query to return events
| rex field=_raw "(?<fullUrl>(?<preFix>https:\/\/anydns\.com:443)\/(?<subDir>[^\/]+)\/(?<suffix>.*))"
| timechart count by subDir

Please take a note of all four fields fullUrl, preFix, subDir and suffix. You can use any combination of these in the above timechart something like | timechart count by preFix or say
| timechart count by suffix and so on...

[jandresaedo]

Thank you for your's answers guys, I'm good now.

See ya.
JA

[DalJeanis]

Sounds like you want to ignore the actual filename, and stop your URL at the last slash.

Everything before the break just generates test data. the "meat" is the rex.

| gentimes start=10/1/16 end=10/5/16          | eval URL = "https://anydns.com:443/event/anyother.xml"
| append [| gentimes start=10/3/16 end=10/7/16 | eval URL = "https://anydns.com:443/cupcake/any.json"]
| append [| gentimes start=10/1/16 end=10/5/16 | eval URL = "https://anydns.com:443/cupcake/any.json"]
| append [| gentimes start=10/2/16 end=10/4/16 | eval URL = "https://anydns.com:443/cupcake/any.json"]
| append [| gentimes start=10/2/16 end=10/7/16 | eval URL = "https://anydns.com:443/cupcake/someother.json"]
| append [| gentimes start=10/2/16 end=10/4/16 | eval URL = "https://anydns.com:443/something/any.xml"]
| eval _time = starttime

| rex field=URL "(?<suburl>\w+:.*/)"
| timechart count by suburl