Let's break down the search piece by piece:
|
Search fragment |
Description |
|
index=main sourcetype=access_ combined |
You should now be familiar with this search from the earlier recipes in this book. |
|
| eval GET_response=if(method =="GET",response,0) |
Using the eval command, you create a new field called GET_response, whose value is based on the return value of the if function. In this case, if the method is GET, then the value returned is the value of the response field; otherwise, the value returned is 0. |
|
| eval POST_response=if (method=="POST", response,0) |
Using the eval command, you create a new field called POST_response, whose value is based on the return value of the if function. In this case, if the ... |
