I need to extract the uris starting with urlxyz as category1 and urlabc as category 2 and timechart them as column/stacked. On the chart the categories should be the information displayed when a mouseover happens on any of the stacks.
right now my search is like this.
index=xyz sourcetype=xyz GET |rex ="GET|POST\s+(?P[^ ]+?)\s+HTTP"|timechart span=10m count(URL) by URL useother=false usenull=false