@kamlesh_vaghela I have used multiple rex commands since I have few more URL's where userID comes in the urls Below is the final search query I am having, index=myaccount sourcetype=myaccountweb-master Response status=* url=*
| chart count over url by status | addtotals
| foreach *
[
| eval <<FIELD>> = if('<<FIELD>>'==0,"-",'<<FIELD>>')
| eval p_<<MATCHSTR>> = if(isnull(tonumber('<<FIELD>>')),'<<FIELD>>',round(('<<FIELD>>'/Total)*100,2))
| eval p_<<MATCHSTR>> = if('p_<<MATCHSTR>>'<1, "< 1",'p_<<MATCHSTR>>')
| eval <<FIELD>> = if("<<FIELD>>"=="Total",'<<FIELD>>', case('<<FIELD>>'=="-","-",tonumber('<<FIELD>>')>1,'<<FIELD>>'." (".p_<<MATCHSTR>>."%)",1=1,'<<FIELD>>'))
]
| fields - p_* | eval url=lower(url)| rex mode=sed field=url "s/account\/(\d+)\//account\/me\//" | rex mode=sed field=url "s/\d+.\w+|\d+fm|\d+fs\d+/{user}/g" | rex mode=sed field=url "s/accounts\?ip=.*/accounts?ip=__/"| rex mode=sed field=url "s/[^\/]{30,}/*/g" | rex mode=sed field=url "s/(\d|\.){8,}/*/g" | rex mode=sed field=url "s/..:..:..:..:..:../__/"
| rex field="500" "\d+\s\((?<perc>.*)%\)" | sort - perc
| where perc>10 The userID I am having actually its alphanumeric. Few userID have only text, few text and numbers. For few URL's, userID comes in middle, for few URL's userID comes in end. I have replaced few userID's with * for few URLs The problem happens for all the URLs where userID is involving. It would be helpful like instead of all these rex command, for all URL one rexcommand which replaces userID with{user} or something like that and counts their set of URL's as one rather than each one separate.
... View more