Hi on manual it's said that you should use like as like(text, pattern). So could you change your query to: index=dev_env sourcetype="urldata" URL ="*" LoadTime="*"
| eval url_name= case(like(URL, "https://www.pingtest.com/server/server.aspx%" ), "ServerLogin",
like(URL, "https://www.servermonitor/clients/hostname/server.aspx?filetype_id=474&mode=new%"),"Servers",
like(URL,"https://www.pingtest.com/clients/User/Testdata.aspx%") ,"ServersPing"
like(URL, "https://www.pingtest.com/mobileusers/Logins/Login.aspx?testid=1578&actid=21047%"),"MobilePing",
like(URL, "https://www.pingtest.com/User/newuser.aspx?%"),"NewUserPing",true(),0)
| timechart span=1m eval(round(avg(LoadTime),0)) as TimeUsedtoload by url_name r. Ismo
... View more