<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How do I remove multiple relevant URLs from column field of splunk query output in Monitoring Splunk</title>
    <link>https://community.splunk.com/t5/Monitoring-Splunk/How-do-I-remove-multiple-relevant-URLs-from-column-field-of/m-p/560508#M5143</link>
    <description>&lt;P&gt;FYI -- Red marked URLs from the attached image should be remove from the output of splunk query which I shared below ..Please someone help for the same.&lt;BR /&gt;&lt;BR /&gt;Query used&amp;nbsp; in environment&lt;BR /&gt;=====================&lt;BR /&gt;index=claims_pd env=pd_cloud_e sourcetype=claims:cif:ibuapps "https://" NOT "*.gco.net" NOT "*.gcoddc.net" NOT "*gco.net"&lt;BR /&gt;| rex field=_raw "(?&amp;lt;externalURL&amp;gt;https:\/\/.[^\s]+)"&lt;BR /&gt;| stats values(externalURL) as externalURL,list(ResponseMessage) as ResponseMessage, count by ServiceName&lt;BR /&gt;| sort 0 - count&lt;BR /&gt;| dedup externalURL&lt;BR /&gt;|append&lt;BR /&gt;[search sourcetype=claims:cif:ibuapps "javax.net.ssl.SSLException" OR "javax.net.ssl.SSLHandshakeException" OR "Unable to tunnel through proxy" OR "HTTP response '400: Bad Request'" OR "(504)Gateway Timeout" OR "Access is denied" AND (ServiceName OR (doFinally AND "method:handleErrorResponse"))&lt;BR /&gt;| stats list(ResponseMessage) as ResponseMessage, count by ServiceName&lt;BR /&gt;| sort - count&lt;BR /&gt;| return ResponseMessage]&lt;/P&gt;</description>
    <pubDate>Thu, 22 Jul 2021 18:07:54 GMT</pubDate>
    <dc:creator>sivashanmugam</dc:creator>
    <dc:date>2021-07-22T18:07:54Z</dc:date>
    <item>
      <title>How do I remove multiple relevant URLs from column field of splunk query output</title>
      <link>https://community.splunk.com/t5/Monitoring-Splunk/How-do-I-remove-multiple-relevant-URLs-from-column-field-of/m-p/560508#M5143</link>
      <description>&lt;P&gt;FYI -- Red marked URLs from the attached image should be remove from the output of splunk query which I shared below ..Please someone help for the same.&lt;BR /&gt;&lt;BR /&gt;Query used&amp;nbsp; in environment&lt;BR /&gt;=====================&lt;BR /&gt;index=claims_pd env=pd_cloud_e sourcetype=claims:cif:ibuapps "https://" NOT "*.gco.net" NOT "*.gcoddc.net" NOT "*gco.net"&lt;BR /&gt;| rex field=_raw "(?&amp;lt;externalURL&amp;gt;https:\/\/.[^\s]+)"&lt;BR /&gt;| stats values(externalURL) as externalURL,list(ResponseMessage) as ResponseMessage, count by ServiceName&lt;BR /&gt;| sort 0 - count&lt;BR /&gt;| dedup externalURL&lt;BR /&gt;|append&lt;BR /&gt;[search sourcetype=claims:cif:ibuapps "javax.net.ssl.SSLException" OR "javax.net.ssl.SSLHandshakeException" OR "Unable to tunnel through proxy" OR "HTTP response '400: Bad Request'" OR "(504)Gateway Timeout" OR "Access is denied" AND (ServiceName OR (doFinally AND "method:handleErrorResponse"))&lt;BR /&gt;| stats list(ResponseMessage) as ResponseMessage, count by ServiceName&lt;BR /&gt;| sort - count&lt;BR /&gt;| return ResponseMessage]&lt;/P&gt;</description>
      <pubDate>Thu, 22 Jul 2021 18:07:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Monitoring-Splunk/How-do-I-remove-multiple-relevant-URLs-from-column-field-of/m-p/560508#M5143</guid>
      <dc:creator>sivashanmugam</dc:creator>
      <dc:date>2021-07-22T18:07:54Z</dc:date>
    </item>
  </channel>
</rss>

