topic Re: How do I individual count each of them in this path. I would like to spit them then count individually. in Getting Data In

How do I individual count each of them in this path?

thiruyadav17 — Mon, 20 Mar 2023 22:02:20 GMT

So, I wanted to Split the path into multiple events so that i can count whatever i want to count like active or dev or usa or etc.

We have few path i.e below

path=/dev/site/usa/active

path=/prod/site/usa/inactive

path=/dev/site/Germany/cleaning

path=/qa/site/Austria/maintenancemode

So now i want to count each of active by usa, dev
then I want to get the top 5 counts of it.

In the results i want to see the bar graph like
active
cleaning

maintenancemode

instead of whole path.

Note: I don't have backend access.

Re: How do I individual count each of them in this path. I would like to spit them then count individually.

ITWhisperer — Mon, 20 Mar 2023 17:00:17 GMT

| eval part=split(path,"/") | stats count by part

Re: How do I individual count each of them in this path. I would like to spit them then count individually.

somesoni2 — Mon, 20 Mar 2023 20:05:23 GMT

Assuming the format of "path" including location of segments is static, you can extract each segment as separate field, like this

your current search which fetch field path | rex field=path "\/(?<env>[^\/]+)\/site\/(?<country>[^\/]+)\/(?<status>[^\/]+)"

And then run your aggregation per your requirement

your current search which fetch field path | rex field=path "\/(?<env>[^\/]+)\/site\/(?<country>[^\/]+)\/(?<status>[^\/]+)" | stats count by env country status | where country="usa" AND env="dev" AND status="active" | sort 5 -count