Hi. I have a query that returns a number count based on the occurence of 2 keywords:
sourcetype=hwa_other source=/var/tomcat/servers/HAP01/logs/tomcat_access*.log "dealswidget" OR "hotelquerywidget"
| rex "(?<myword>dealswidget|hotelquerywidget)"
| stats count by myword
The results are 2 counts:
1 dealswidget 9847
2 hotelquerywidget 88826
After this i'd like a count on unique URLs. The log lines look like:
(A typical URL is in the log line below and always in that position)
10.186.198.6 - - [29/Jul/2011:00:03:08 -0500] "GET /js/lib/jquery-1.5.js HTTP/1.0" 200 211978 "http://partners.hotels.com/hotelquerywidget/1/1/HCOM_ES-es_ES/hotelquerywidget.html" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30" "5DC1789408E34ECF1A8F25E521617E9D.ut03hap01"
10.186.198.6 - - [29/Jul/2011:00:09:04 -0500] "GET /styles/widget/hcom.external.common.css HTTP/1.1" 200 4255 "http://partners.hotels.com/dealswidget/1/2/1633826/HCOM_NO-no_NO/widget.html" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30" "3EDEC4AAE25F8C92260C2132409F54BC.ut03hap01"
Any help would be appreciated.
... View more