@rmmiller
Thanks .
I recently got a query to get the url hits based on regex based on 3 min time interval.
The same thing i need to check for a set of user list(e:10 users) i have.so basically regex remains same.
below query i used to get the hit count of url regexes based on 3 min time interval.
index=jira host="hostname" "rapidViewId=" OR "/user/mention" OR "/jira/secure/StructureBoard.jspa" OR "softwareplant-biggantt/1.0/ppm/program" OR "/lastVisited" source="/opt/atlassian/jira/logs/access_log.2020-04-28" | eval chartingField=case(match(_raw,"rapidViewId="),"board", match(_raw,"/user/mention"), "mention",match(_raw,"StructureBoard.jspa"), "structure",match(_raw,"softwareplant-biggantt/1.0/ppm/program"),"gantt",match(_raw,"/lastVisited"),"last visited" ) | timechart span=3m count by chartingField
... View more