We have the search below which gives us the count of all our URLs in events in real-time, but we have a few events where URL is missing.
Now we need to assign a certain URL value to those events which do not have a URL, but subsearch is not working for this as it is a real-time search.
For ex: We have events where URL is missing, but have the value "EXPRESS". We need to filter those events by this value and assign them a separate URL value called "EXPRESS.com". Can someone please suggest how we can do this?
Below is our search we used:
index=datapower host="10.71.8.170" NOT URL=https://raly.com tag=prod
|stats count(datapower_response_time) as count by URL|
For the search above, we need to add events that contain "Express" to EXPRESS.COM (as we don't have URL for these events)