I am running a search like
index="main" app="student-api" "path"="/v1/enroll"
And in the events (when I select Raw) I see this type of output
{
"application":"student-api",
"environment":"prod",
"timestamp":"2023-02-23T08:24:23.163Z",
"traceId":"2a2e3980-e61b-4927-b270-1785569d5af8",
"response":{
"statusCode":"200",
},
"request":{
"protocol":"HTTP/1.1",
"method":"POST",
"path":"/v1/enroll",
"headers":{
"Accept-Encoding":[
"gzip"
],
"Accept-Language":[
"en_US"
],
"Content-Type":[
"application/json; charset=UTF-8"
],
"Experiments":[
"{\"n\":\"first_enroll\",\"p\":\"BACKEND_SERVICE\",\"v\":\"FIRST\"},{\"n\":\"ttl_ios\",\"p\":\"BACKEND_SERVICE\",\"v\":\"default\"}]}"
],
"TraceId":[
"2a2e3980-e61b-4927-b270-1785569d5af8"
]
},
"cookies":"",
"body":""
},
"duration":115
}
Now, I am trying to generate count based on how many of the ttl_ios has value = default ({\"n\":\"ttl_ios\",\"p\":\"BACKEND_SERVICE\",\"v\":\"default\"}] is where it is default) vs non-default - so the result should look like say -
variant count
default 10
non-default 3
(default and non-default are the only 2 values it can have)
Appreciate your help on this. Thanks
| rex max_match=0 "ttl_ios\\\\\",\\\\\"p\\\\\":\\\\\"\w+\\\\\",\\\\\"v\\\\\":\\\\\"(?<ttl_ios>[^\"]+)\\\\\""
| stats count by ttl_ios
| rex max_match=0 "ttl_ios\\\\\",\\\\\"p\\\\\":\\\\\"\w+\\\\\",\\\\\"v\\\\\":\\\\\"(?<ttl_ios>[^\"]+)\\\\\""
| stats count by ttl_ios
thanks @ITWhisperer - that worked
one q - what if the data format changed? aka it looked like
{\"n\":\"ttl_ios\",\"v\":\"default\",\"p\":\"BACKEND_SERVICE\"}]}
If you do it like this, it would cope with either situation.
| rex max_match=0 "ttl_ios\\\\\",.*?\\\\\"v\\\\\":\\\\\"(?<ttl_ios>[^\"]+)\\\\\""