How to dynamically create a field for each API with eventstats?

[philip_102uk]

I have an index with several API calls and I would like to dynamically create a field for each API which can then be used to create a timechart for each API call. My query looks like this:

| bucket span=1s _time | eventstats count AS TPS by _time

I want to have a TPS (transactions per second) for each API call, so TPS_api_pathsuffix where api_pathsuffix is the pathsuffix of each API. So effectively I want to have for each API call a table with all the TPSs for that API.

I would really appreciate any help you can give me.

[sundareshr · Accepted solution]

Try this

| bucket span=1s _time | eventstats count AS TPS_api_pathsuffix by _time api_pathsuffix 

[philip_102uk]

Hi sundareshr,

I don't see how this is going to help me, can you please explain?

[philip_102uk]

Actually, having tested the proposed solution it seems to be working. I will continue testing and then accept it as the answer if it solves the problem.

[philip_102uk]

Thank you sundareshr, this has worked.