topic Re: split url and perform a count on it. in Getting Data In

split url and perform a count on it.

rh990 — Wed, 24 Aug 2016 19:28:20 GMT

You'll have to pardon the newbie question. I'm sure this is crazy easy, but I'm having the worst time figuring it out. My logs have a URL field in them and I want to split out the query string and do a count on the URL minus the query sting. I've tried a bunch of different things, but nothing I've tried has really gotten me what I'm after.

An example might be like:
www.nasdaq.com/symbol/?Load=true&Search=ssss
www.nasdaq.com/symbol/?Load=true&Search=ddd
www.nasdaq.com/symbol/?Load=true&Search=xxx
www.nasdaq.com

I'd like to see
www.nasdaq.com/symbol/ 3
www.nasdaq.com 1

Re: split url and perform a count on it.

sundareshr — Wed, 24 Aug 2016 19:50:06 GMT

Try this

... | eval url=mvindex(split(request_uri, "?"), 0) | stats count by url

Re: split url and perform a count on it.

rh990 — Wed, 24 Aug 2016 20:02:12 GMT

I've tried this one and I get no results for statistics when I use it. I see plenty of results for events, but nothing for statistics.

index="sss" Application.AppName = "xxxx*" Header.Type=inbound | eval url=mvindex(split(Service.URL, "?"), 0) | stats count by url

Re: split url and perform a count on it.

somesoni2 — Wed, 24 Aug 2016 20:12:53 GMT

Your field name contains special characters, so in eval (and where) command, use it within single quotes. Like this

index="sss" Application.AppName = "xxxx*" Header.Type=inbound | eval url=mvindex(split('Service.URL', "?"), 0) | stats count by url

Re: split url and perform a count on it.

rh990 — Wed, 24 Aug 2016 20:18:07 GMT

The special character in the field name was it. Thank you so much. I figured it was something simple, I'm just new to it.

Re: split url and perform a count on it.

aluruguna — Tue, 08 Nov 2016 22:17:35 GMT

I want answer for exactly same question but I want the count value of everything group urls i.e---

An example might be like:
www.nasdaq.com/symbol/?Load=true&Search=ssss
www.nasdaq.com/symbol/?Load=true&Search=ddd
www.nasdaq.com/symbol/?Load=true&Search=xxx
www.nasdaq.com

I'd like to see
www.nasdaq.com-4

I was using "My search|stats count by url " but I m getting all the results like this
URL Count
www.nasdaq.com/symbol/?Load=true&Search=ssss 1
www.nasdaq.com/symbol/?Load=true&Search=ddd 1
www.nasdaq.com/symbol/?Load=true&Search=xxx 1
www.nasdaq.com 1

I'd like to see
URL Count
www.nasdaq.com 4