Sourcehost Renaming
((_collector="AWS-SP-DEV" and _sourceCategory="http input")
) _sourceHost="/aws/lambda/dev-c4c-student-event-publisher-v1" OR _sourceHost="/aws/lambda/dev-student-queue-publisher-v1" OR _sourceHost="/aws/lambda/dev-database-student-queue-v1" OR _sourceHost="/aws/lambda/dev-database-student-history-queue-v1"
| parse "'entity-internal-id': '*'" as student_id
| parse "'action': '*'" as action
| timeslice 1d
| count (student_id) as Event_Triggered by _sourcehost
Output:
# | _sourcehost | Event_Triggered |
1 | /aws/lambda/dev-database-student-queue-v1 | 11 |
2 | /aws/lambda/dev-c4c-student-event-publisher-v1 | 11 |
3 | /aws/lambda/dev-database-student-history-queue-v1 | 11 |
4 | /aws/lambda/dev-student-queue-publisher-v1 | 11 |
is there a way to sort the output for sourcehost as per the query order in Sourcehost
OR
do we have the option to rename the (_sourcehost=aws/lambda/dev-database-student-queue-v1) = abc likewsie..
Please suggest
Please sign in to leave a comment.
Comments
0 comments