Group results by a keyword in a particular field

[bushrangerjones]

Hi,

I am trying to group (bring together) the results by a keyword in a certain field. For example, I want to group all of the URLs that include "Hightail". As you can see from the screenshot I have several Hightail URLs. I want to group them all together, and turn the results in to a dashboard. Would this be possible?

Current query:

index=proxy sourcetype=bluecoat cs_categories="*File Storage*" cs_username!="-" cs_method!="unknown" cs_host="*hightail*" | stats sum(cs_bytes) AS bytes_uploaded sum(sc_bytes) AS bytes_downloaded by cs_username cs_host sc_filter_result | eval megabytes_down=bytes_downloaded/1024/1024 | eval megabytes_up=bytes_uploaded/1024/1024 | rename cs_username as "User",cs_host as "Cloud storage URL", sc_filter_result AS "Result", megabytes_up as "Downloaded (MB)", megabytes_down as "Uploaded (MB)"| ......... replace OBSERVED with ALLOWED in Result | sort by -"Downloaded (MB)" | table User, displayName, department, Result, "Cloud storage URL", "Downloaded (MB)", "Uploaded (MB)"

Thank you

[somesoni2 · Accepted solution]

Try this

index=proxy sourcetype=bluecoat cs_categories="*File Storage*" cs_username!="-" cs_method!="unknown" cs_host="*hightail*" | stats sum(cs_bytes) AS bytes_uploaded sum(sc_bytes) AS bytes_downloaded by cs_username cs_host sc_filter_result  | eval cs_host=if(match(cs_host,".*\.hightail\.com"),"XXX.hightails.com",cs_host) | stats sum(*) as * by cs_username cs_host sc_filter_result | eval megabytes_down=bytes_downloaded/1024/1024 | eval megabytes_up=bytes_uploaded/1024/1024 | rename cs_username as "User",cs_host as "Cloud storage URL", sc_filter_result AS "Result", megabytes_up as "Downloaded (MB)", megabytes_down as "Uploaded (MB)"| ......... replace OBSERVED with ALLOWED in Result | sort by -"Downloaded (MB)" | table User, displayName, department, Result, "Cloud storage URL", "Downloaded (MB)", "Uploaded (MB)"

[bushrangerjones]

Thanks for that! It works, however it is not picking up URLS like this one - storage.us1.hightail.com. As that URL is made up of 4 parts and not 3 I suppose?

[bushrangerjones]

I just added this line:

eval cs_host=if(match(cs_host,".*\.au1\.hightail\.com"), "XXX.hightail.com",cs_host)

Seem to have done the job! Thanks