Hi,
I have 4 fields in my index
ID, Method, URL, HTTP_responsecode
ID is in the form of XXXX-YYYY-ZZZZ-AAAA,
Now, I want to delimit the ID column and extract YYYY value then run a stats command with the delimited value by HTTP_responsecode
Something as below
Delimited_ID | HTTP_responsecode | Count |
YYYY | 200 | 10 |
Please could you help on how to delimit the value in the above format mentioned and how to use the new delimited value in a stats command
There are a couple of ways to get the desired field from the ID.
| rex field=ID "-(?<Delimited_ID>[^-]+)"
``` OR ```
| eval tmp = split(ID, "-")
| eval Delimited_ID = mvindex(tmp,1)
Use the new field in a stats command just as you would any other field.
| stats count as Count by Delimited_ID, HTTP_responsecode