Ah, been a while for stats profile and I don't have the means to test right now, but how about under each switch match:
STATS::incr "ContentType" "Images_bytes" [HTTP::payload length]
or another profile:
STATS::incr "ContentLength" "Images" [HTTP::payload length]
So the rule would expand to:
when HTTP_RESPONSE {
switch -glob [HTTP::header "Content-type"] {
"image/*" {
STATS::incr "ContentType" "Images"
STATS::incr "ContentLength" "Images" [HTTP::payload length]
}
...and so on. I assumed another profile for the content length, but you could keep in the same profile with different fields as long as you don't exceed the max. Untested, but it just might work! HTH