Hello!
I have many events, and I have a search that returns only the events that contain the to field.
index="my_index_qa" sourcetype="example-qa" to=*
The results are a list of events that have the following pattern:
db271cf8678c -2023-01-12 15:08:32.157 [app=app-name, traceId=traceid-value, spanId=spanid-value, INFO 1 [llEventLoop-5-5] filter.FilterBeingUsed : c=class, m=method, method=GET, to=http://example.url.com/path/extra, route=https://example.url.com/redirect/route, headers={X-Forwarded-For=[IPADDRESS, IPADDRESS2], X-Forwarded-Proto=[http], X-Forwarded-Port=[80], Host=[EXAMPLE-HOST], app-device=[DEVICE-INFO], app-user=[devicce-info-os-info], app-os=[APP-OS-VERSION], user-agent=[user-agent-example], app-version=[app.version.example], Origin=[origin-app]}
I want to be able to group by the to= values, so I can count the number of times they repeat, create charts and do some other metrics.
Is it possible? How can I do this?
Thank you for any help in advance. And sorry if I wrote anything wrong, english is not my main language.
Have you tried this?
index="my_index_qa" sourcetype="example-qa" to=*
| stats count by to
Any time you want to count something, use stats (or eventstats or streamstats or timechart) count. Grouping by a field implies the by option.
That helped! Thank you a lot! 😊
Have you tried this?
index="my_index_qa" sourcetype="example-qa" to=*
| stats count by to
Any time you want to count something, use stats (or eventstats or streamstats or timechart) count. Grouping by a field implies the by option.