timechart of traffic v commerce

[londondev]

Based on example 4 at http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart I'm trying to generate a timechart of site traffic plus commerce traffic (commerce means our URL matches /Commerce/) but commerce traffic isn't returning anything. I assume there's a problem with my use of eval(uri_path=...

This is the query:
sourcetype=access_combined | timechart count(eval(method="GET")) AS GETs, count(eval(uri_path="/Commerce/*")) AS Commerce

Any ideas what I'm doing wrong?

[londondev]

thanks Chris. "sourcetype=access_combined | top uri_path" includes '/Commerce/AIM' - looks like Ayn's answer below works though

[Ayn · Accepted solution]

Your comparison in the eval command is not valid. Wildcard are not supported in a comparison using the equals sign, but are instead performed by using the match function. So, something like this should work better:

sourcetype=access_combined | timechart count(eval(method="GET")) AS GETs, count(eval(match(uri_path,"^/Commerce/"))) AS Commerce

[londondev]

thanks Ayn, this seems to work

[chris]

Does uri_path contain any values? What does "sourcetype=access_combined | top uri_path" return? If the field extraction/recognition is ok then it should work (maybe "*/Commerce/*" will work) otherwise the fields might have to be extracted first (but you've already done that right?).