Hi guys!!
I have this search:
index=temp sourcetype=sdc cs_host="*mto.ree.*" WT_dl=0 NOT (cs_uri_stem ="*/es-es/paginas/inicio.aspx" OR cs_uri_stem =*/results.aspx* OR cs_uri_stem =*/_layouts/* OR cs_uri_stem =*/_catalogs/* OR cs_uri_stem =/personal* )
| fillnull value="Sin Título" WT_ti
| top limit=0 WT_ti, cs_uri_stem,WT_device
| eval WT_ti= urldecode(WT_ti)
| eval percent = round(percent,2)
| eval Escritorio= if(WT_device=="Escritorio",count,0)
| eval iPhone= if(WT_device=="IPhone",count,0)
| eval iPad= if(WT_device=="IPad",count,0)
| eval Otros= if(WT_device=="Linux",count,0)
| eval WT_ti = if (WT_ti== "Mi perfil - Noticias", "Mi perfil - Novedades",WT_ti )
| rename WT_ti as Titulo,cs_uri_stem as URL, count as "Paginas_Vista", percent as "Porcentaje_%"
| search Titulo=Comunidades
Attach an image of results, my problem, I need not show de Column WT_device and show the results in a single line. It's possible?
Thanks for you time!!
@mogoj , Can you add this please:
| stats sum(*) as * by Titulo URL
Search compet:
index=temp sourcetype=sdc cs_host="*mto.ree.*" WT_dl=0 NOT (cs_uri_stem ="*/es-es/paginas/inicio.aspx" OR cs_uri_stem =*/results.aspx* OR cs_uri_stem =*/_layouts/* OR cs_uri_stem =*/_catalogs/* OR cs_uri_stem =/personal* )
| fillnull value="Sin Título" WT_ti
| top limit=0 WT_ti, cs_uri_stem,WT_device
| eval WT_ti= urldecode(WT_ti)
| eval percent = round(percent,2)
| eval Escritorio= if(WT_device=="Escritorio",count,0)
| eval iPhone= if(WT_device=="IPhone",count,0)
| eval iPad= if(WT_device=="IPad",count,0)
| eval Otros= if(WT_device=="Linux",count,0)
| eval WT_ti = if (WT_ti== "Mi perfil - Noticias", "Mi perfil - Novedades",WT_ti )
| rename WT_ti as Titulo,cs_uri_stem as URL, count as "Paginas_Vista", percent as "Porcentaje_%"
| search Titulo=Comunidades
| stats sum(*) as * by Titulo URL
@mogoj , Can you add this please:
| stats sum(*) as * by Titulo URL
Search compet:
index=temp sourcetype=sdc cs_host="*mto.ree.*" WT_dl=0 NOT (cs_uri_stem ="*/es-es/paginas/inicio.aspx" OR cs_uri_stem =*/results.aspx* OR cs_uri_stem =*/_layouts/* OR cs_uri_stem =*/_catalogs/* OR cs_uri_stem =/personal* )
| fillnull value="Sin Título" WT_ti
| top limit=0 WT_ti, cs_uri_stem,WT_device
| eval WT_ti= urldecode(WT_ti)
| eval percent = round(percent,2)
| eval Escritorio= if(WT_device=="Escritorio",count,0)
| eval iPhone= if(WT_device=="IPhone",count,0)
| eval iPad= if(WT_device=="IPad",count,0)
| eval Otros= if(WT_device=="Linux",count,0)
| eval WT_ti = if (WT_ti== "Mi perfil - Noticias", "Mi perfil - Novedades",WT_ti )
| rename WT_ti as Titulo,cs_uri_stem as URL, count as "Paginas_Vista", percent as "Porcentaje_%"
| search Titulo=Comunidades
| stats sum(*) as * by Titulo URL
Thanks!!!!
Can you perhaps sketch the desired result (e.g. in excel or so)? I don't entirely follow what you are looking for.
Hi Frank,
I have this-->
Titulo URL WT_device Paginas Vista Porcertanje Escritorio Otros Ipad iPhone
Comunidades Paginas/default.aspx Escritorio 28 8,02 28 0 0 0
Comunidades Paginas/default.aspx iPhone 2 0,57 0 0 0 2
Comunidades Paginas/default.aspx iPad 2 0,57 0 0 2 0
And i Like this-->
Titulo URL Paginas Vista Porcentaje Escritorio Otros Ipad iPhone
Comunidades Paginas/default.aspx 32 9,16 28 0 2 2