Specific substrings of fields (not all!) for stats to create a chart

[fastdude1]

Hi

I have done a fare amount of looking around and I have given up and decided to ask for help. I have extracted a field and i can easily use the search over my field for example
source="src" get_request=*foo.php*


Now I would like to know how often in the logs the get_request field contains the following:

foo.php

bar.php

fuzz.php


However i am total uninterested in every other possible value in that field.
I could do the search three different times, but i would like to half it all graphed so i can compare which of the three is say most accessed.


I have tried things like using count however it seems to be only able to do literals that match the entire field.



Any help would be appreciated.

[Ayn]

Something like this perhaps? First you create a search that will match all the events you're interested in. Then in your chart command you either split by get_request...

source=src get_request=*foo.php* OR get_request=*bar.php* OR get_request=*fuzz.php* | chart count by get_request

...or if there are a lot of different URL's that share similar filenames and you just want the stats by the filenames instead of all different URL's, split up your stats by matching on the different specific filenames you mention.

source=src get_request=*foo.php* OR get_request=*bar.php* OR get_request=*fuzz.php* | chart count(eval(match(get_request,"foo.php"))), count(eval(match(get_request,"bar.php"))), count(eval(match(get_request,"fuzz.php")))

[martin_mueller]

First you'd write a search that only yields events with those three files matching the get_request field (wildcards + OR), second you'd pipe that into a stats count by get_request to do the report.

If you're looking for the most accessed pages in general you can use the top command in a subsearch to build the filter before doing the report.