source="http:Emerson_P1CDN"
| spath host
| spath client_ip
| spath status_code | where status_code=200
| spath referer | where referer=""
| spath path | search path NOT ("*wcsextendedsearch" OR "*EmersonSKUListingView" OR "*EmersonProductListingView" OR "*CartRefreshStatusJSON" OR "*PriceAjaxView" OR "*AjaxSerialNumber" OR "*UnsupportedBrowserErrorView" OR "*LogonForm"OR "*MiniCart" OR "*MiniShopCartDisplayView" OR "*AnalyticsPageView" OR "*AjaxAccountLinkDisplay" OR "*.css" OR "*.js" OR "*.woff2" OR "*.woff" OR "*.gif" OR "*.png" OR "*.jpg" OR "*.ico" OR "*.pdf" OR "*.html" OR "*.txt" OR "*.xml" OR "*/ClickInfo" OR "*thumb")
| bin _time span=1m
| stats count by _time,host,path,client_ip | where count >= 100 | sort - count
Does the query at the top is correct?, because we want to count the total events of _time,host,path and client_ip per minute
Yes, stats will count the events which match the unique combinations of those fields
You might want to consider
| spath referer | where referer="" OR isnull(referer)
I will, but is it looks good? does the stats count. count the events?
thanks
Yes, stats will count the events which match the unique combinations of those fields
Thank you so much!