topic Re: Remove duplicate URLs from search result in Monitoring Splunk

Remove duplicate URLs from search result

r_s01 — Sat, 21 Dec 2024 08:23:15 GMT

Trying to get success and failure status count using below query but its not filtering out the duplicate URLs, Can someone help me into this? I want result in less number of rows but lob, URI, API_Status and its count should show.

"*/prescriptions/eni/api/api-cw/*" (URI != "*/prescriptions/eni/api/api-cw/legacySession/cache*") | stats count by lob,URI,API_Staus

Result is coming as below,

Re: Remove duplicate URLs from search result

PickleRick — Sat, 21 Dec 2024 10:47:12 GMT

1. You're using a very old Splunk version judging by the screenshot.

2. Your initial search is very, very ineffective (Splunk cannot use its index of terms, it has to look through every single event to find your sought for ones)

3. What do you mean by "filter duplicate URL"? You're counting by a triplet - url, status and lob, whatever that is. So you'll get a separate result for each combination of those three values. If you don't want to break it down by status, don't include that field in the BY clause.

Re: Remove duplicate URLs from search result

r_s01 — Sat, 21 Dec 2024 11:12:41 GMT

Thanks for response, There is a field called URI some URI is coming as duplicate. how i can adjust query so that duplicate URI won't come?

Re: Remove duplicate URLs from search result

isoutamo — Sat, 21 Dec 2024 15:03:38 GMT

If you want results by URI then don’t put anything else after by. But then the results is not same as you have with your current query.

.... | stats values(status) as status .... by URI

just replace …. before by with those other fields what you want to see.

But probably this is not what you are looking for?

Can you told what you need to know, not how you try to do it?

Re: Remove duplicate URLs from search result

r_s01 — Mon, 23 Dec 2024 15:55:57 GMT

I am trying to get response on the basis on coming status codes from message.outgoingResponse.istURL, But problem is that there is no field to read return status code from below shared screen shot URL, is there any way we can get status code as we got from any URL on browser?

Query :-

index="uhcportals-prod-logs" sourcetype=kubernetes container_name="myuhc-sso" logger="com.uhg.myuhc.log.SplunkLog" message.ssoType="Outbound" | spath "message.incomingRequest.partner" | rename message.incomingRequest.partner as "SSO Partner" | search "SSO Partner"=sso_SSOPartner_Amwell | stats count by message.outgoingResponse.istURL

Re: Remove duplicate URLs from search result

isoutamo — Mon, 23 Dec 2024 12:45:40 GMT

Can you give some sample data which helps us to understand this better and found suitable solution? Please anonymous that data if/when needed!