Hi,
I'm looking at charting the most common file types, based on a string in a log of "..., http_path=/a/b/c/blah.gif, next-field=..." for example. I've extracted the "gif" field easily enough, and so I can trivially see all file types. BUT how do I cover the case of there being no extension? e.g. "..., http_path=/a/b/app, next-field=..."? These web app locations are the significant majority of the requests, and I'd really like to have a "No Ext" chunk on my pie chart. How can I do this?
If I go back to where the log is generated, then I can hack out the extension there, make a new field, like http_ext and leave it empty, but that doesn't seem like the right thing to do.
Cheers
Chris
Do your extractions first, then for each event (before using stats functions), replace the fields that are null by a text value.
example for the field myfield;
| eval myfield=if(isnull(myfield),"missing",myfield)
Do your extractions first, then for each event (before using stats functions), replace the fields that are null by a text value.
example for the field myfield;
| eval myfield=if(isnull(myfield),"missing",myfield)
acid, thanks, I looked for this command for months !!!
Oh, hang on... Shouldn't this be using "| fillnull value=NONE myfield"? Isn't that going to be much more efficient?
brilliant, thanks