Case condition check issue

[mugilbala]

Application logs execution time for many apis. I am interested in 2 apis with following urls.
/apis/deviceservice/2.0/accounts/acountid/devices
/apis/deviceservice/2.0/accounts/devices/deviceId

I am trying to print a report with following query.

index="xyz" source="*access.log"
| eval Service=case(
Url like ("%/apis/deviceservice/2.0/accounts/devices/%") AND Method="GET", "Get Specific Device",
Url like ("%/apis/deviceservice/2.0/accounts/%/devices"), "Get Devices Account Level",

true(), Url )
| table ExternalId, Time, Service | xyseries ExternalId Service Time

Sample data:
2018-06-12 07:40:45,643 GMT DEBUG Bytes=3653|HttpStatus=200|Method=GET|Time=42|Url=https://hostip/apis/deviceservice/2.0/accounts/devices/9930cf66-3480-4e7a-b31b-539287dfcd10|LogMessa... 200
2018-06-12 07:40:45,643 GMT DEBUG Bytes=3653|HttpStatus=200|Method=GET|Time=45|Url=https://hostip/apis/deviceservice/2.0/accounts/e7546806-a507-49dc-853c-7dcae1a85f92/devices|LogMessa... 200
2018-06-12 07:40:45,644 GMT DEBUG Bytes=3653|HttpStatus=200|Method=GET|Time=38|Url=https://hostip/apis/deviceservice/2.0/accounts/devices/9930cf66-3480-4e7a-b31b-539287dfcd10|LogMessa... 200
2018-06-12 07:40:45,708 GMT DEBUG Bytes=3653|HttpStatus=200|Method=GET|Time=71|Url=https://hostip/apis/deviceservice/2.0/accounts/e7546806-a507-49dc-853c-7dcae1a85f92/devices|LogMessa... 200
2018-06-12 07:41:45,689 GMT DEBUG Bytes=3653|HttpStatus=200|Method=GET|Time=28|Url=https://hostip/apis/deviceservice/2.0/accounts/devices/9930cf66-3480-4e7a-b31b-539287dfcd10|LogMessa... 200

How ever, "Url like ("%/apis/deviceservice/2.0/accounts/%/devices")" condition is not working as expected and prints the full url with different account ids.

Can you help me with the correct condition to achieve the result?

[niketn · Accepted solution]

[UPDATED ANSWER]
Based on raw events provided, you would need to use following updated match() condition. .* has been added as beginning pattern.

@mugilbala you can use following match() eval function instead of like to use regular expression based pattern match.

| makeresults
| eval data="2018-06-12 07:40:45,643 GMT DEBUG Bytes=3653|HttpStatus=200|Method=GET|Time=42|Url=https://hostip/apis/deviceservice/2.0/accounts/devices/9930cf66-3480-4e7a-b31b-539287dfcd10|LogMessage=HTTP 200;2018-06-12 07:40:45,643 GMT DEBUG Bytes=3653|HttpStatus=200|Method=GET|Time=45|Url=https://hostip/apis/deviceservice/2.0/accounts/e7546806-a507-49dc-853c-7dcae1a85f92/devices|LogMessage=HTTP 200;2018-06-12 07:40:45,644 GMT DEBUG Bytes=3653|HttpStatus=200|Method=GET|Time=38|Url=https://hostip/apis/deviceservice/2.0/accounts/devices/9930cf66-3480-4e7a-b31b-539287dfcd10|LogMessage=HTTP 200;2018-06-12 07:40:45,708 GMT DEBUG Bytes=3653|HttpStatus=200|Method=GET|Time=71|Url=https://hostip/apis/deviceservice/2.0/accounts/e7546806-a507-49dc-853c-7dcae1a85f92/devices|LogMessage=HTTP 200;2018-06-12 07:41:45,689 GMT DEBUG Bytes=3653|HttpStatus=200|Method=GET|Time=28|Url=https://hostip/apis/deviceservice/2.0/accounts/devices/9930cf66-3480-4e7a-b31b-539287dfcd10|LogMessage=HTTP 200"
| makemv data delim=";"
| mvexpand data
| rename data as _raw
| KV
| eval Service=case( 
     match(Url,".*\/apis\/deviceservice\/2\.0\/accounts\/devices\/"), "Get Specific Device", 
     match(Url,".*\/apis\/deviceservice\/2\.0\/accounts\/[^\/]+\/devices"), "Get Devices Account Level",
     true(), Url )

[mugilbala]

Hi,
Thanks for quick response. I have added sample data. I tried your suggestion and it did not work. Can you please check the sample data provided and let me know if any change is required for the search query?

Thank you.

[niketn]

Please try the updated answer as per your question following is the regular expression based match() you need:

  <yourCurrentSearch>
 | eval Service=case( 
      match(Url,".*\/apis\/deviceservice\/2\.0\/accounts\/devices\/"), "Get Specific Device", 
      match(Url,".*\/apis\/deviceservice\/2\.0\/accounts\/[^\/]+\/devices"), "Get Devices Account Level",
      true(), Url )

[mugilbala]

Thank you. It worked as needed. Appreciate your help.

[vasanthmss]

post some sample data.

[mugilbala]

Hi,
I have added some sample data. Please check.