Exercise 1

Create "Other" dashboard by using below searches:

   search:

index=web sourcetype=access_combined_wcookie method="GET"|stats count as GetCount | gauge GetCount 4000 8000 12000 16000</query>

         

        search:

         index=web sourcetype=access_combined_wcookie method="POST"|stats count as PostCount | gauge PostCount 4000 8000 12000 16000

      

        search:

          index=web sourcetype=access_combined_wcookie|stats count by action

        search:

          index=web|timechart sum(bytes) AS Bytes

Exercise 2