How to resolve the below issue ?

[JyotiP]

I have the following query which is giving me all the api which cache value is HIT or MISS.

host=*localTest* sourcetype="perf" Path "/api/*/" cache="MISS" OR cache="HIT" | stats count by Path,cache

and the result of the above script id as follows

/api/prof/v1/rootpath/5922                                              MISS    1
/api/prof/v1/rootpath/5923                                          MISS    3
/api/prof/v1/rootpath/5936                                          MISS    3
/api/analytics/v2/Column                                             MISS   5
/api/analytics/v2/Metadata/Portfolio                                    MISS    34
/api/analytics/v2/Metadata/PositionState                                MISS    4
/api/analytics/v2/ViewDescriptor                                        MISS    4
/api/benchmarks/ratehistory/v1/activeFinanceBenchmarkIds                MISS    5
/api/commissions/voting/v2/Broker                                       MISS    12
/api/reporting/v2/status/events/00917c7c-ae03-4657-965f-0cc2e38410f9    MISS    2
/api/reporting/v2/status/events/02401fb4-522b-4e5b-8d5f-a9bffa7b94fe    MISS    2
/api/reporting/v2/status/events/0b29b690-f052-4fc1-baed-c5d1aae53ff5    MISS    2
/api/reporting/v2/status/events/0bc11171-2ce1-4bba-b7fc-0805eb1d4c74    MISS    59
/api/reporting/v2/status/events/0db6e04c-8f82-44fe-96a5-ed96626544d7    MISS    2
/api/reporting/v2/status/events/0dd17dc2-6e35-4ece-88eb-4868996578fc    MISS    60
/api/reporting/v2/status/events/123d8971-be15-4e1c-9713-911900156f18    MISS    60
/api/reporting/v2/status/events/1346fe60-ace1-42ec-aa24-d28c7a3b084f    MISS    5
/api/reporting/v2/status/events/135e4e87-2325-4d60-9e35-9169f675856b    MISS    60

I want to group and add all the which have /api/prof/v1/rootpath/ and /api/reporting/v2/status/events/ to one separate value and rest should be untouched just like below,

/api/prof/v1/rootpath/                                                  MISS    7
/api/analytics/v2/Column                                                MISS    5
/api/analytics/v2/Metadata/Portfolio                                    MISS    34
/api/analytics/v2/Metadata/PositionState                                MISS    4
/api/analytics/v2/ViewDescriptor                                        MISS    4
/api/benchmarks/ratehistory/v1/activeFinanceBenchmarkIds                MISS    5
/api/commissions/voting/v2/Broker                                       MISS    12
/api/reporting/v2/status/events/                                        MISS    252

[renjith_nair · Accepted solution]

@JyotiP,

Try

"your current search"
|eval Path=case(like(Path, "/api/prof/v1/rootpath/%"),"/api/prof/v1/rootpath/"
                ,like(Path,"/api/reporting/v2/status/events/%"),"/api/reporting/v2/status/events/"
                ,1=1,Path)
| stats sum(count) as count by Path,cache