How to count and compare amount of regex matches

Question

I want to use Sumo Logic to count how often different APIs are called. I want to have a table with API call name and value. My current query is like this:

_sourceCategory="my_category"
| parse regex "GET.+443 (?<getUserByUserId>/user/v1/)\d+" nodrop
| parse regex "GET.+443 (?<getUserByUserNumber>/user/v1/userNumber)\d+" 
| count by getUserByUserId, getUserByUserNumber

This gets correct values but they go to different columns. When I have more variables, table becomes very wide and hard to read.

Answering my own question because I figured it out: I need to use same group name for all rexexes. Like this: _sourceCategory="my_category" | parse regex "GET.+443 (?/user/v1/)\d+" nodrop | parse regex "GET.+443 (?/user/v1/userNumber)\d+" | count by endpoint — Pekka, Nov 17 '21 at 07:27
You can add your answer as a properly posted answer if you like, then mark it as the accepted one. The reason I wanted to let you know was that it makes the question show up as having a green accepted answer in searches and more people can find it easier. Thanks! — Joe, Nov 19 '21 at 11:13

score 0 · Accepted Answer · answered Nov 23 '21 at 06:58

0

I figured it out, I need to use same group name for all rexexes. Like this:

_sourceCategory="my_category"
| parse regex "GET.+443 (?<endpoint>/user/v1/)\d+" nodrop
| parse regex "GET.+443 (?<endpoint>/user/v1/userNumber)\d+"
| count by endpoint

answered Nov 23 '21 at 06:58

Pekka

2,175
15
20

How to count and compare amount of regex matches

1 Answers1