There are 2 kinds of log:
one is error log
the other is access log.
In error log, there is a field requestUrl . value format is https://google.com/home.html .
In access log, there is field requestPath , value format is /home.html .
I want to combine them with requestUrl and requestPath , and then count the error rate.
The query I used likes:
index=app..eventName=xxx| rex field=requestUrl "https://google.com(?<**path**>.*)" | stats count as failureCount | appendcols [search index=app .. requestPath=$**path**$| stats count as total]
The variable **path** cannot be passed to requestPath in subsearch . I can only get total=0 .
Anyone know how to get the path from the first search passed to subsearch?
... View more