Trying to format a URL to aggregate in to results
I have a search that is of the syntax:
"/url/a/b/c" AND _sourceCategory="/source" AND NOT ".jpg" AND NOT ".svg" AND NOT "favicon.ico"
| parse "|d=* |e" as time
| time/toLong(1000000) as seconds
| pct(seconds, 50) as median_resp_time, pct(seconds, 95) as pct95_resp_time, avg(seconds) as avg_resp_time, max(seconds) as max_resp_time, min(seconds) as min_resp_time, count(seconds) as counts, sum(seconds) as total_seconds by url
| sort total_seconds | limit 50
What I would like to do is if a url matches "/url/a/b/c/d/*" - I would like to roll up all those results as one result and aggregate as one line in the above search. Is this possible to do? Ideally I would do it for more than one url query, I was thinking of some sort of a replace function, but it seems to break the search so perhaps I'm doing it incorrectly.
So in summary:
Search for something like this: "/url/a/b/c"
Aggregate the URL's that match: "/url/a/b/c/d/*" and "/url/a/b/c/e*" and "/url/a/b/c/f/*"
And in my results have something like :
url median_resp_time pct95_resp_time avg_resp_time max_resp_time min_resp_time counts total_seconds
"/url/a/b/c/a" 0.05 0.16 0.12 174.04 0.00 12534980 1469335.93
"/url/a/b/c/b" 0.05 0.16 0.12 174.04 0.00 12534980 1469335.93
"/url/a/b/c/c" 0.05 0.16 0.12 174.04 0.00 12534980 1469335.93
"/url/a/b/c/d/*" 0.10 0.61 0.25 192.85 0.00 5493049 1364981.01
"/url/a/b/c/e*" 0.37 1.90 0.61 723.86 0.00 1741951 1055900.37
"/url/a/b/c/f/*" 0.06 0.16 0.14 131.32 0.00 4908816 685244.21
"/url/a/b/c/g" 0.05 0.16 0.12 174.04 0.00 12534980 1469335.93
"/url/a/b/c/h" 0.05 0.16 0.12 174.04 0.00 12534980 1469335.93
-
Did you try using substring operator ?
| if(length (url) < 12, url, substring (url, 0, 12) ) as normalized_url
| ... by normalized_url
Please sign in to leave a comment.
Comments
2 comments