Query for Multiple URLs

[kvanwagoner]

I'm sure this will be easy for you guys but I"m struggling with it..
I need to modify this query to look for both the http://open/FinalNumbers as well as a URL of https://apicorp.company/open/FinalNumbers

"A GET was made to Open API - Status: OK (http://open/FinalNumbers" | spath AppID | search Environment=prod | timechart count by Environment | bin span=7d _time | stats avg(prod)

Please help!

[jpolvino · Accepted solution]

Sounds like you want to OR the URLs:

"A GET was made to Open API - Status: OK (http://open/FinalNumbers" OR "A GET was made to Open API - Status: OK (https://apicorp.company/open/FinalNumbers" | spath AppID | search Environment=prod | timechart count by Environment | bin span=7d _time | stats avg(prod)

Also before the first pipe, you should specify an index and sourcetype at a minimum for efficiency.

[kvanwagoner]

Thanks! That worked!

[jpolvino]

Please "accept as answer" the solution that fixes the issue, to help others. Thanks, and glad it worked!