I am doing a search and evaluating count, avg RT based on some URL patterns. Below are the URLs for my category pages :
//Food/Back-to-School/Breakfast/Breakfast-Bars/c/1015001004 //Food/Back-to-School/Breakfast/Cereal/c/1015001001 //Home-%26-Lifestyle/Beauty/Cosmetics/Eyes/c/2004001001
Using below query gives me the different results for different URLs, but I want results grouped into 1 Relative URL.
sourcetype=apache:access request_uri="\*/c/\*" | search apache_responsetime=* | chart perc90(apache_responsetime) over request_uri
What query I should use to get desired results?
So I recommend creating a new field which normalizes the request uris. Also you don't need a separate search apache_responsetime=*. Just combine it. The default is to AND the searches.
It is not clear what the space of your URLs is. If you want to lump all Food and all Home life style pages together then maybe something like:
sourcetype=apache:access request_uri="\*/c/\*" apache_responsetime=* | rex field=request_uri "//(?<category>\S+)/" | chart perc90(apache_responsetime) by category
Your query is grouping all URLs post '/c/' i.e.
/Food/Back-to-School/Breakfast/Breakfast-Bars/c/1015001001 /Food/Back-to-School/Breakfast/Breakfast-Bars/c/1015001002 /Food/Back-to-School/Breakfast/Breakfast-Bars/c/1015001003 into /Food/Back-to-School/Breakfast/Breakfast-Bars/c/
I need all URLs before /c/ as well to group into 1 URL
Since you're looking at only specific type of URIs (only one pattern), you can simply do something like this
sourcetype=apache:access request_uri="\*/c/\*" apache_responsetime=* | stats perc90(apache_responsetime) | eval request_uri="*/c/*" | table requiest_uri perc90(apache_responsetime)
A more generic approach would be this (where you can look for multiple URI patterns)
sourcetype=apache:access (request_uri="\*/a/\*" OR request_uri="\*/b/\*" OR...other patterns ) apache_responsetime=* | eval request_uri=case(searchmatch(request_uri="\*/a/\*"),"*/a/*", request_uri="\*/b/\*"),"*/b/*",..literal/static values for other patterns..) | chart perc90(apache_responsetime) over request_uri