Splunk查询-从json值识别模式并将其命名

Question

{
  "message": {
    "correlation": "12345678",
    "headers": {},
    "protocol": "HTTP/1.1",
    "remote": "111.11.11.111",
    "requestMethod": "GET",
    "requestPath": "/abc/<dynamic_value>/xyz",
    "type": "request"
  }
}

从“ message.requestMethod”和“ message.requestPath”中，我需要找到唯一的组合并为其命名。

尝试了以下类似的方法，但无法正常工作： searchquery | eval api = case (message.requestMethod = GET AND message.requestPath="/abc/<dynamic_value>/xyz", "GET_VERSION_API", message.requestMethod = POST AND message.requestPath="/abc/<dynamic_value>/xyz", "POST_VERSION_API", 1 = 1, "default") | stats count by api