Hello,
is there any way to improve this search by reducing appendcols number ? Source is the same, only download_time average should be calculate according url string regex.
Current search :
sourcetype="my_source_type" source="frt" url="/F-" | timechart avg(download_time) as "Family" | appendcols [search
sourcetype="my_source_type" source="*frt" url="/P-" | timechart avg(download_time) as "Product"] | appendcols [search
sourcetype="my_source_type" source="*frt" url="/C-" | timechart avg(download_time) as "Category"] | appendcols [search
sourcetype="my_source_type" source="*frt" url="/main" | timechart avg(download_time) as "Homepage"]
Thanks,
Sure, I think you can eliminate appendcols
altogether in this search. Try something like this:
sourcetype="my_source_type" source="frt" (url="/F-" OR url="/P-" OR url="/C-*" OR url="/main") | eval Identifier=case(url == "/F-", "Family",url == "/P-", "Product",url == "/C-*", "Category", url == "/main", "Homepage") | timechart avg(download_time) by Identifier
Hello
It would be nice to have some sample events, but with the information you had provided try this:
sourcetype="my_source_type" source="frt" (url="/F-" OR url="/P-" OR url="/C-*" OR url="/main" ) | rex field="url" "\/(?<group>main|(C|P|F))" | timechart avg(download_time) by group
You could rename the outfput fields if needed.
Regards