I am trying to count the number of 200 response codes from an access log. can you please help in getting me the output.
26/Jan/2017:08:16:33 PST "POST /webservice/services/serviceABC HTTP/1.1" A_Cell/A_node/A_Cluster_jvm 117 118 200
26/Jan/2017:08:16:33 PST "POST /webservice/services/serviceABC HTTP/1.1" B_Cell/B_node/B_Cluster_jvm_2 164 819 200
26/Jan/2017:08:16:33 PST "POST /webservice/services/serviceABC HTTP/1.1" A_Cell/C_node/C_Cluster_jvm_1197 917 200
Log looks like the above. Is it possible to get the output of stats count by each cell, node and and each jvm? I dont need reading the response codes, because i am doing "* * 200" in base search
Try like this
Updated based on new sample data
your base search | rex "^([^\"]+\"){2}\s+[^\/]+\/(?<node>[^\/]+)\/(?<jvm>\S+)\s+.+(?<response_code>\d+)$" | where response_code=200 | stats count by node jvm
Try like this
Updated based on new sample data
your base search | rex "^([^\"]+\"){2}\s+[^\/]+\/(?<node>[^\/]+)\/(?<jvm>\S+)\s+.+(?<response_code>\d+)$" | where response_code=200 | stats count by node jvm
Thanks for the response, I also have the date and time in the log. Your regex is picking up "Jan". I dont actually care about method or URI. I just need stats by cell, node and jvm.
Try the updated answer (original answer updated).
Thanks for the answer. Is there a tool or way to get or learn how to use these regex codes?