topic Re: Disabling the effect of wildcard in a Query in Splunk Search

Disabling the effect of wildcard in a Query

shabdadev — Mon, 03 Jul 2017 06:41:10 GMT

Hi All ,

I have this query :

index=no host=los*  sourcetype= plp  (  path=/desktop /pl/* ) OR ( path=/mobile/pl/*   ) |  stats perc95(responseTime) as "95th Perc Response Time" by path

I Want the result to come like this as shown below( coagulated response time for the desktop and mobile separately ) :

Path                                                           95th Perc Response Time
/desktop/pl/*                                            234
/mobile/pl/*                                              2344

But the result is showing all the url's in path section just because i have used a wildcard in that place .

how to modify this query to get the expected the result. ??

Re: Disabling the effect of wildcard in a Query

niketn — Mon, 03 Jul 2017 07:39:12 GMT

@shabdadev, in order to avoid your code from getting escaped, use the code button (101010) while posting your query. Please try to Edit your question and re-post with code button query and sample table.

Re: Disabling the effect of wildcard in a Query

shabdadev — Mon, 03 Jul 2017 08:06:06 GMT

HI Niket i have modified the post ..please see again

Re: Disabling the effect of wildcard in a Query

javiergn — Mon, 03 Jul 2017 08:56:44 GMT

Try this instead (NOT TESTED so there might be typos):

index=no host=los*  sourcetype= plp  (path="/desktop/pl/*" OR  path="/mobile/pl/*") 
| eval pathSummary = if(match(path, "/desktop/pl/*"), "/desktop/pl/*", "/mobile/pl/*")
|  stats perc95(responseTime) as "95th Perc Response Time" by pathSummary

The second line groups your paths based on your preferences and then assigns that into a new field that you can use in your stats.

Thanks,
J

Re: Disabling the effect of wildcard in a Query

shabdadev — Mon, 03 Jul 2017 09:08:12 GMT

Thanks a lot 🙂 ..it worked

Re: Disabling the effect of wildcard in a Query

niketn — Mon, 03 Jul 2017 09:12:07 GMT

Since you have only two paths (or systems) i.e. desktop and mobile in your base search. Following should work:

 index="no" host="los*"  sourcetype="plp"  (  path="/desktop/pl/*" ) OR ( path="/mobile/pl/*"   ) 
| eval path=if(match(path,"desktop"),"desktop","mobile")
| stats perc95(responseTime) as "95th Perc Response Time" by path

Re: Disabling the effect of wildcard in a Query

niketn — Mon, 03 Jul 2017 09:12:48 GMT

Oh too late. You already got your answer 🙂

Re: Disabling the effect of wildcard in a Query

shabdadev — Mon, 03 Jul 2017 09:22:25 GMT

hahahha Thanks you Niket too....i guess logic is same in both . Thanks again 🙂