How to consolidate data into a sum within timeseries

Hillman — Fri, 31 Jul 2026 08:51:37 GMT

Currently I am use the following DQL to list out the web request count for our API calls:

timeseries { sum(webrequest) }, by: { http.response.status_code, server.address, TenantID, Tenant, url.path } | fieldsAdd Tenant = if (tolong(TenantID) == 6, "Singapore") | fieldsAdd Tenant = if (tolong(TenantID) == 7, "Australia", else:Tenant) | fieldsAdd Tenant = if (tolong(TenantID) == 8, "Philippine", else:Tenant) | fieldsAdd Tenant = if (tolong(TenantID) == 9, "Malaysia", else:Tenant) | fieldsAdd Tenant = if (tolong(TenantID) == 10, "Thailand", else:Tenant) | fieldsAdd Tenant = if (tolong(TenantID) == 11, "Hong Kong", else:Tenant) | fieldsAdd Tenant = if (tolong(TenantID) == 13, "Indonesia", else:Tenant) | fieldsAdd Tenant = if (tolong(TenantID) == 14, "Vietnam", else:Tenant) | fieldsAdd Tenant = if (tolong(TenantID) == 15, "New Zealand", else:Tenant) | fieldsAdd Tenant = if (tolong(TenantID) == 22, "CDM", else:Tenant) | filterOut isNull(Tenant) | filter http.response.status_code >= 404 and http.response.status_code <= 599 | filter matchesValue(server.address, "abc.com") | fieldsRemove server.address

However, I have found there are quite a few of API calls which involve individual membership numbers:

I try to use DQL to remove the membership number from the URL:

| fieldsAdd URL = url.path | fieldsAdd URL = if( matchesValue(url.path, "*/memberships/*"), concat( splitString(url.path, "/memberships/")[0], "/memberships" ), else: URL )

However, the resultant data end up look this:

Is there any way I can sum up the URL request count and consolidate /memberships into a single entry?

topic How to consolidate data into a sum within timeseries in DQL

How to consolidate data into a sum within timeseries