N # of url formats

Comments

2 comments

  • Avatar
    Kevin Keech

    You should be able to do something like the following to pull the ID

    | parse regex "GET \/foo.*(?:&|\?)someId=s(?<some\_Id>.{4})"

    | count by some_Id

     

    The "where" is not necessary since you cover this as part of the parse expression and any messages that do not match the parse expression will be dropped.

     

    0
    Comment actions Permalink
  • Avatar
    Cory Wilkerson

    Perfect. Thanks.

    0
    Comment actions Permalink

Please sign in to leave a comment.