Hello,
In order to clean our filtering rules we'd like to check if some of our old URL's are still in use (an if yes - how many times in last 90 days). Basically we'd like to perform the query below:
index=nginx sourcetype="nginx:plus:access"
| search uri_path=
| stats count
The problem is that there are almost 600 URL's we need to check.
We'd like to know if there is a way to put all the URL's in a lookup and then perform a kind of `foreach` search.
Thanks for the help.
Alex.
↧