How to write a regular expression to extract and count the number of calls per URL from Apache web access logs?

macadminrohit — Mon, 29 Jan 2018 19:13:47 GMT

Hi,

I am trying to analyse the Apache web access logs for the below textpayload:

IP -- [Date +0000] "POST /PATH/URI/ HTTP/1.1" 200 1.599 0 "https://URL/to/PAGES.html" "Mozilla/5.0 (

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0" "IP, IP" Correlation-ID="10 Digit number"

Basically, I want to get a number of calls per URL. Here calls are "https://URL/to/PAGES.html" and URL is /PATH/URI/ HTTP/1.1 , Any help is highly appreciated.

thanks

Re: How to write a regular expression to extract and count the number of calls per URL from Apache web access logs?

msivill_splunk — Tue, 30 Jan 2018 14:46:48 GMT

Below is an example to get you going....

| makeresults count=2 
| streamstats count 
| eval _raw = CASE ( count=1,"IP -- [Date +0000] \"POST /PATH/URI/ HTTP/1.1\" 200 1.599 0 \"https://URL/to/PAGES.html\" \"Mozilla/5.0 ( Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0\" \"IP, IP\" Correlation-ID=\"10 Digit number\"", count=2,"IP -- [Date +0000] \"POST /PATH/URI/ HTTP/1.1\" 200 1.599 0 \"https://URL/to/PAGES2.html\" \"Mozilla/5.0 (Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0\" \"IP, IP\" Correlation-ID=\"10 Digit number\"") 
| rex field=_raw "[^\"]*\"[^\"]*\"[^\"]*\"(?<url>[^\"]*)" 
| stats count by url

You might also want to consider looking at Splunk Add-on for Apache Web Server which contains pre-canned fields extractions for apache logs

topic How to write a regular expression to extract and count the number of calls per URL from Apache web access logs? in Splunk Search

How to write a regular expression to extract and count the number of calls per URL from Apache web access logs?

Re: How to write a regular expression to extract and count the number of calls per URL from Apache web access logs?