Change search results for page counts

[JohannesGmelin]

Hey Community,

I need help with a custom search. At the moment I get a result looks like this:

/AuthorizationAdmin/javax.faces.resource/calendar.js.xhtml?ln=org.richfaces

But I need just the first word after the first slash without the other trash just like this:

/AuthorizationAdmin/

This is my search:

| tstats summariesonly=t count FROM datamodel=Web WHERE Web.site="*" "Web.eventtype"=pageview GROUPBY Web.uri | eventstats sum(count) as Total | eval percent = round((count/Total)*100,2) . "%" | fields - Total | rename percent AS "% Pageviews"

Thanks for your help!!!

[woodcock · Accepted solution]

Like this:

| tstats summariesonly=t count FROM datamodel=Web WHERE Web.site="*" "Web.eventtype"=pageview GROUPBY Web.uri
| eventstats sum(count) as Total
| eval percent = round((count/Total)*100,2) . "%"
| fields - Total
| rename percent AS "% Pageviews"
| rex field=Web.uri mode=sed "s/^(\/[^\/]+\/).*$/\1/"

[JohannesGmelin]

Great thank you! 🙂

I've tried this at the User User Journey Flow too (Landing Page) but no result 😕

Do you have any idea why?
The other problem is that I'm getting now 10 times a page for example like this: /admin/
because the ending is different but it should be just one entry for one page you understand?

Thanks a lot!

LG Johannes

[woodcock]

Try this search: does it do what you expect?

| makeresults 
| eval Web.uri="/first/second/third/fourth" 
| rex field=Web.uri mode=sed "s/^(\/[^\/]+\/).*$/\1/"

[JohannesGmelin]

I've sent you an email with a picture for a better understanding. I'm not allowed to make this picture public 😕