@DalJeanis , URLs are not in predictable format. Is it possible to use uri_path in the query to come-up with expected results ?
I tried below query , it didnt work.
index=test sourcetype=123:abc:abc tag::source=AP
uri_path="/url/url1" OR uri_path="/url/url2"
OR uri_path="/url/url3" OR uri_path="/url/url4"
| timechart span=1d count by "uri_path" limit=0 | addtotals
| foreach 'uri_path' [ |eval pct_uri_path = round(100*pct_uri_path/Total,0)]
For testing purpose , I also tried below query. it didnt work. I am getting same output which was printed in my previous post as "Current Results"
index=test sourcetype=123:abc:abc tag::source=AP
uri_path="/url/url1" OR uri_path="/url/url2"
OR uri_path="/url/url3" OR uri_path="/url/url4"
| timechart span=1d count by "uri_path" limit=0 | addtotals
| foreach '/url*' [ |eval pct_url = round(100*pct_url/Total,0)]
... View more