Currently I am use the following DQL to list out the web request count for our API calls:
timeseries { sum(webrequest) }, by: { http.response.status_code, server.address, TenantID, Tenant, url.path }
| fieldsAdd Tenant = if (tolong(TenantID) == 6, "Singapore")
| fieldsAdd Tenant = if (tolong(TenantID) == 7, "Australia", else:Tenant)
| fieldsAdd Tenant = if (tolong(TenantID) == 8, "Philippine", else:Tenant)
| fieldsAdd Tenant = if (tolong(TenantID) == 9, "Malaysia", else:Tenant)
| fieldsAdd Tenant = if (tolong(TenantID) == 10, "Thailand", else:Tenant)
| fieldsAdd Tenant = if (tolong(TenantID) == 11, "Hong Kong", else:Tenant)
| fieldsAdd Tenant = if (tolong(TenantID) == 13, "Indonesia", else:Tenant)
| fieldsAdd Tenant = if (tolong(TenantID) == 14, "Vietnam", else:Tenant)
| fieldsAdd Tenant = if (tolong(TenantID) == 15, "New Zealand", else:Tenant)
| fieldsAdd Tenant = if (tolong(TenantID) == 22, "CDM", else:Tenant)
| filterOut isNull(Tenant)
| filter http.response.status_code >= 404 and http.response.status_code <= 599
| filter matchesValue(server.address, "abc.com")
| fieldsRemove server.address
However, I have found there are quite a few of API calls which involve individual membership numbers:
I try to use DQL to remove the membership number from the URL:
| fieldsAdd URL = url.path
| fieldsAdd URL = if(
matchesValue(url.path, "*/memberships/*"),
concat(
splitString(url.path, "/memberships/")[0],
"/memberships"
),
else: URL
)
However, the resultant data end up look this:
Is there any way I can sum up the URL request count and consolidate /memberships into a single entry?
Featured Posts
