Now I'm just trying to see successful or failure transactions list sorted by the URI.
My example query -
index=mslogs "successful"|stats count by URI
Now the problem is, the result is coming as -
Basically I want to remove the random string part in the 'URI' field. Different URI has different random parts and those random parts are present differently in the URI. I'm willing to write regex to handle all the scenario in URI, but I want to replace them with '*' so that if I do a 'stats' or timechart, single URI.