Hi,
Am looking for conditional eval search for my results, could you please help me with correct query.
index=myindex source="access" api="sendverification?email=*&op=passwordrecovery" OR api="*reset-password.html" OR api="*updatepassword" response_code=200 OR response_code=400
| eval API=case(api LIKE "%op=passwordrecovery", "Request Password Reset", api LIKE "%reset-password.html", "Email Link", api LIKE "%updatepassword", "updatepassword")
| chart count by API
but api=updatepassword has response_code 200(success) and 400(failure), i need to display api updatepassword, response_code 200 as success and api updatepassword, response_code 400 as failure
as result i need display all four api account with count like
Date, API, Count
2020-04-22, Request Password Reset, 10
2020-04-22, Email Link, 5
2020-04-22, Success, 9
2020-04-22, Failure, 1
Thanks!
Pavan
... View more