chart over query string

[chixor]

Hi guys,

I have an apache log. I want to be able to chart the count of occurances of a particular query string in the uri_path.

eg.

/path/file?q1=v1&q2=v2&q3=v3
/path/file?q1=v3&q2=v1&q3=v2
/path/file?q1=v2&q2=v3&q3=v1

I want to get:

uri_path   count
q2=v1      63
q2=v2      26
q2=v3      82

I've worked out how to regex on the query string, but I can't work out how to chart count over specific q2 values of uri_path and ignore changes in q1 and q3.

[Stephen_Sorkin · Accepted solution]

I'd assume that you already have the q2 field extracted automatically. You can verify that it is and search:

... | top q2

[chixor]

oh, hahaha I was over thinking it. Thanks, Stephen.