Hey Community,
I need help with a custom search. At the moment I get a result looks like this:
/AuthorizationAdmin/javax.faces.resource/calendar.js.xhtml?ln=org.richfaces
But I need just the first word after the first slash without the other trash just like this:
/AuthorizationAdmin/
This is my search:
| tstats summariesonly=t count FROM datamodel=Web WHERE Web.site="*" "Web.eventtype"=pageview GROUPBY Web.uri | eventstats sum(count) as Total | eval percent = round((count/Total)*100,2) . "%" | fields - Total | rename percent AS "% Pageviews"
Thanks for your help!!!
Like this:
| tstats summariesonly=t count FROM datamodel=Web WHERE Web.site="*" "Web.eventtype"=pageview GROUPBY Web.uri
| eventstats sum(count) as Total
| eval percent = round((count/Total)*100,2) . "%"
| fields - Total
| rename percent AS "% Pageviews"
| rex field=Web.uri mode=sed "s/^(\/[^\/]+\/).*$/\1/"
Like this:
| tstats summariesonly=t count FROM datamodel=Web WHERE Web.site="*" "Web.eventtype"=pageview GROUPBY Web.uri
| eventstats sum(count) as Total
| eval percent = round((count/Total)*100,2) . "%"
| fields - Total
| rename percent AS "% Pageviews"
| rex field=Web.uri mode=sed "s/^(\/[^\/]+\/).*$/\1/"
Great thank you! 🙂
I've tried this at the User User Journey Flow too (Landing Page) but no result 😕
Do you have any idea why?
The other problem is that I'm getting now 10 times a page for example like this: /admin/
because the ending is different but it should be just one entry for one page you understand?
Thanks a lot!
LG Johannes
Try this search: does it do what you expect?
| makeresults
| eval Web.uri="/first/second/third/fourth"
| rex field=Web.uri mode=sed "s/^(\/[^\/]+\/).*$/\1/"
I've sent you an email with a picture for a better understanding. I'm not allowed to make this picture public 😕