Parsing Non-Structured Fields
Sometimes you might need to parse fields that are not well structured within the message. In this example we are counting hits by browser. Since there is no browser field in the message, we simply search for the browser name and store it in its own field for future aggregation.
_sourceCategory=Apache/Access
| if (agent matches "*MSIE*",1,0) as ie
| if (agent matches "*Firefox*",1,0) as firefox
| if (agent matches "*Safari*",1,0) as safari
| if (agent matches "*Chrome*",1,0) as chrome
| sum(ie) as ie, sum(firefox) as firefox, sum(safari) as safari, sum(chrome) as chrome
-
You're exactly right Arjit. If the field already exists, a simple count will take care of it. For example,
_sourceCategory=Apache/Access
| count by user_agentHowever, this would provide a large list that has all variations of browsers, operating systems, versions, etc. But if you want to get a count just by browser, then this query above helps you count occurrences for each browser, regardless of the other variables.
Hope this helps.
Mario
Please sign in to leave a comment.
Comments
3 comments