How can i get only one data on column table instead of having multiple due to params?

[DougiieDee]

operationName	urls	avg_time	max_time	count
MethodUsingGET	https://www.google.com/api/v1/571114808/CAR.202 https://www.google.com/api/v1/571114899	3255	3255	2
UsingGET	https://www.googleA.com/api/v1/571114888/api/ https://www.googleB.com/api/v1/571114877/api/	1316.889	5345	18

I would only want one url but it should count others as well. Is there a way?

[ITWhisperer]

What search did you use to get these results? What do your events look like?

[DougiieDee]

index=*
| rex "(?i)\".*?\":(?P<operationId>\d+)(?=,)"
| rex "(?i)\".*?\":(?P<responseTime>\d+)(?=,)"
| rex "(?i)\".*?\":(?P<Url>\d+)(?=,)"
| stats values(Url) as urls, avg(responseTime) as avg_time, max(responseTime) as max_time, count by operationId

The results are in pretty in splunk but when i download the csv file all the results are in like 1 line and doesnt have data like it showed

[ITWhisperer]

Try something this

| stats avg(responseTime) as avg_time, max(responseTime) as max_time, count by operationId, Url

[DougiieDee]

the results are like this

operationId	Url	avg_time	max_time	count
accountUsingGET	https://*/api/account/history/sourceaccount	1675.33333	4914	3
accountUsingGET	https://*/api/account/history/sourceaccount	1324.7	5345	10
LineUsingPOST	https://*/api/lines/1012/activate	1224	1224	1
LineUsingPOST	https://*/api/lines/1014/activate	1015	1015	1
LineUsingPOST	https://*/api/lines/1017/activate	1506	1015	1

but i only want one data from operationId and Url but it should count all and give avg response time as well, like this, is there a way?

operationId	Url	avg_time	max_time	count
accountUsingGET	https://*/api/account/history/sourceaccount	1675.33333	4914	13
LineUsingPOST	https://*/api/lines/1012/activate	1224	1224	3

[ITWhisperer]

I don't think so - if you do stats by operationId, Url you will only get one row for each unique combination of these fields, which is what you said you wanted.