sumologic

How to count and compare amount of regex matches

I want to use Sumo Logic to count how often different APIs are called. I want to have a table with API call name and value. My current query is like this:

_sourceCategory="my_category"
| parse regex "GET.+443 (?<getUserByUserId>/user/v1/)\d+" nodrop
| parse regex "GET.+443 (?<getUserByUserNumber>/user/v1/userNumber)\d+" 
| count by getUserByUserId, getUserByUserNumber

This gets correct values but they go to different columns. When I have more variables, table becomes very wide and hard to read.

Solution

  • I figured it out, I need to use same group name for all rexexes. Like this:

    _sourceCategory="my_category"
| parse regex "GET.+443 (?<endpoint>/user/v1/)\d+" nodrop
| parse regex "GET.+443 (?<endpoint>/user/v1/userNumber)\d+"
| count by endpoint