Hello Guys,
I have 3 different directory in the same URL, for example:
So I want count every sub-directory in the URL, and I tried with the following search:
index=some_index url="https://anydns.com:443/*/" | timechart count(url) by url
But my line chart or the statistics in the Eje x splits into every URL and I want to see 1 graph with statistics about how much picks had one URL in some time.
Thank you and sorry for my bad english.
There might be many ways but how about trying something like this :
your query to return events
| rex field=_raw "(?<fullUrl>(?<preFix>https:\/\/anydns\.com:443)\/(?<subDir>[^\/]+)\/(?<suffix>.*))"
| timechart count by subDir
Please take a note of all four fields fullUrl, preFix, subDir and suffix
. You can use any combination of these in the above timechart something like | timechart count by preFix
or say
| timechart count by suffix
and so on...
There might be many ways but how about trying something like this :
your query to return events
| rex field=_raw "(?<fullUrl>(?<preFix>https:\/\/anydns\.com:443)\/(?<subDir>[^\/]+)\/(?<suffix>.*))"
| timechart count by subDir
Please take a note of all four fields fullUrl, preFix, subDir and suffix
. You can use any combination of these in the above timechart something like | timechart count by preFix
or say
| timechart count by suffix
and so on...
Thank you for your's answers guys, I'm good now.
See ya.
JA
Sounds like you want to ignore the actual filename, and stop your URL at the last slash.
Everything before the break just generates test data. the "meat" is the rex.
| gentimes start=10/1/16 end=10/5/16 | eval URL = "https://anydns.com:443/event/anyother.xml"
| append [| gentimes start=10/3/16 end=10/7/16 | eval URL = "https://anydns.com:443/cupcake/any.json"]
| append [| gentimes start=10/1/16 end=10/5/16 | eval URL = "https://anydns.com:443/cupcake/any.json"]
| append [| gentimes start=10/2/16 end=10/4/16 | eval URL = "https://anydns.com:443/cupcake/any.json"]
| append [| gentimes start=10/2/16 end=10/7/16 | eval URL = "https://anydns.com:443/cupcake/someother.json"]
| append [| gentimes start=10/2/16 end=10/4/16 | eval URL = "https://anydns.com:443/something/any.xml"]
| eval _time = starttime
| rex field=URL "(?<suburl>\w+:.*/)"
| timechart count by suburl