Aggregating WildCards in Sumologic

Comments

4 comments

  • Avatar
    Kevin

    Hi Kendrick,

    I would try and use an IF statement to normalize the URLs with the variable IDs  Ex.

    _sourceCategory=production 
    | keyvalue auto
    | where (path matches "/v1/driver_locations" OR path matches "/v1/driver_locations/*" or path matches "/v1/vehicle_locations" or path matches "/v1/vehicle_locations/*")
    | if (path matches "/v1/driver_locations/*), "/v1/driver_locations/id", If(path matches "/v1/vehicle_locations/*", "/v1/vehicle_locations/id", path)) as path
    | count by path
    0
    Comment actions Permalink
  • Avatar
    Kendrick Roland

    Hey Kevin,

     

    I seem to be getting and error with your solution above:

    ')' expected but '"' found.

    0
    Comment actions Permalink
  • Avatar
    Kevin

    Sorry I missed a quote when I typed that up. Fixed below. 

     

    _sourceCategory=production 
    | keyvalue auto
    | where (path matches "/v1/driver_locations" OR path matches "/v1/driver_locations/*" or path matches "/v1/vehicle_locations" or path matches "/v1/vehicle_locations/*")
    | if (path matches "/v1/driver_locations/*)", "/v1/driver_locations/id", If(path matches "/v1/vehicle_locations/*", "/v1/vehicle_locations/id", path)) as path
    | count by path
    1
    Comment actions Permalink
  • Avatar
    Kendrick Roland

    Yeah I figured. This works. Thanks, Kevin!

    0
    Comment actions Permalink

Please sign in to leave a comment.