I am trying to do a search match based on a number of different criteria.
The below does not work.
sourcetype="iis-2" | extract auto=true | search cs_username | eval Product=if(searchmatch("cs_uri_stem=*/Product/Product*Overview/|*/Product/Product*Overview/Global*|*/Product/Product*Overview/EMEA/*|*/Product/Product*Overview/APAC/|*/Product/Product*Overview/Americas/"),1,null()) | stats count(Product) as Product by date_month
The below does return results but I want to combine Product 1-5 into one column and add the results.
sourcetype="iis-2" | extract auto=true | search cs_username |
eval Product1=if(searchmatch("cs_uri_stem=*/Product/Product*Overview/ |
eval Product2=if(searchmatch("cs_uri_stem=*/Product/Product*Overview/Global*"),1,null()) |
eval Product3=if(searchmatch("cs_uri_stem=*/Product/Product*Overview/EMEA/*"),1,null()) |
eval Product4=if(searchmatch("cs_uri_stem=*/Product/Product*Overview/APAC/*"),1,null()) |
eval Product5=if(searchmatch("cs_uri_stem=*/Product/Product*Overview/Americas/*"),1,null()) |
stats count(Product1) as Product1 count(Product2) as Product2 count(Product3) as Product3 count(Product4) as Product4 count(Product5) as Product5 by date_month
I cant use */Product/Product*Overview/*
as there are pages other than the ones above I do not want to include.
I am stuck, hope you can help.
This is the way you would use OR with rex. If your strings are correct, then this should work with the exception of /Product/Product.*Overview/. I left that out because from the looks of it you are specifying the overview/X strings that you want, and you said there are many that you don't want:
| rex field="cs_uri_stem" ".*(?<PRODUCT>/Product/Product.*Overview/Global.*|/Product/Product.*Overview/EMEA/.*|/Product/Product.*Overview/APAC/.*|/Product/Product.*Overview/Americas/.*)$" | eval Contact=if(match(cs_uri_stem,"/Contacts/ContactProfile/"),1,null())