fields @timestamp, @message, @paths
| filter @logStream = "collection-wallet-gateway" and @message like /Log Response/
| parse "path=http://wallets.simpaisa.com/v2/wallets/transaction/*," as @path
| sort @timestamp desc
| stats count(*) as @total by @path
| stats sum(@total) as @totaltransactions by @path
| display @message, @path, @total, @totaltransactions
It's throwing error:
Compile Error - Unknown symbols found in or after stats: @message
Filter all the @message where there is path= and parse the path= to list all urls and also count initiate, verify, finalize. Then finding sum of all and puting all in a single table
Removing "@message" from display resolved the error message. This is because I was grouping the data by "@path" and that's making difficult for "@message" to get grouped.