https://community.splunk.com/t5/Splunk-Search/How-to-extract-an-endpoint-until-certain-value-and-not-the/m-p/462298#M130320 <P>It worked perfectly thanks, is this still doing something in the search "| regex Endpoint="^\W\D+\w.\D+" ? because I tried this regular expression and worked but didn't cut the rest of the endpoint like yours did, "| rex field=Endpoint "(?\/\w+\/\w+\/\w+)", can you break it down for me en explain it? thank you so much</P> Wed, 05 Feb 2020 18:17:12 GMT dnavia29 2020-02-05T18:17:12Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-an-endpoint-until-certain-value-and-not-the/m-p/462296#M130318 <P>Hello, I am trying to simplify a search in Splunk taking only my principal endpoints and not the detail transactions, I am using regex to filter this but it still show me all the details, what I want to see is the availability of the endpoint and not separated for transaction. <BR /> here is my query.</P> <P><CODE><BR /> sourcetype="api-core" <BR /> | rename request.body{}.value.request.http_status_code as http_req_result <BR /> | convert num(http_req_result) as http_res <BR /> | where http_res &gt; 0 <BR /> | rename http_res as "RequestStatus", request.body{}.value.request.endpoint as Endpoint <BR /> | regex Endpoint="^\W\D+\w.\D+" <BR /> | stats count(eval(RequestStatus&gt;0)) as total, count(eval(RequestStatus&gt;200)) as errors by Endpoint <BR /> | eval disponibilidad=(100-(errors/total*100)) <BR /> | eval disponibilidad = round(disponibilidad,0)<BR /> | table Endpoint, disponibilidad<BR /> | sort disponibilidad<BR /> </CODE><BR /> This returns in this result</P> <P><CODE><BR /> /accounts/v1/credit_lines/0205087584/transactions 0<BR /> /accounts/v1/credit_lines/0205202927/transactions 0<BR /> /accounts/v1/credit_lines/0207414358/transactions 0<BR /> /accounts/v1/credit_lines/0207440484/transactions 0<BR /> /accounts/v1/credit_lines/0209367114/transactions 0<BR /> /accounts/v1/credit_lines/0210909021/transactions 0<BR /> /accounts/v1/credit_lines/0210997318/transactions 0<BR /> /accounts/v1/credit_lines/0211293790/transactions 0<BR /> /accounts/v1/credit_lines/0213211449/transactions 0<BR /> /accounts/v1/credit_lines/0213285496/transactions 0<BR /> /accounts/v1/credit_lines/0213523143/transactions 0<BR /> /accounts/v1/credit_lines/0214261457/transactions 0<BR /> /authentication/v1/mfa/168831676/otp 0<BR /> /clients/v1/clients/165839218/reward_points 0<BR /> /clients/v1/clients/121049368 50<BR /> /clients/v1/clients/166947472<BR /> </CODE><BR /> What I want is to group by endpoint, example "/accounts/v1/credit_lines", "/authentication/v1/mfa", "/clients/v1/clients/" and see all the transactions, not separated. </P> <P>Please your help, Thanks in advance</P> Wed, 05 Feb 2020 16:28:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-an-endpoint-until-certain-value-and-not-the/m-p/462296#M130318 dnavia29 2020-02-05T16:28:44Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-an-endpoint-until-certain-value-and-not-the/m-p/462297#M130319 <P>This should help.</P> <PRE><CODE>sourcetype="api-core" | rename request.body{}.value.request.http_status_code as http_req_result | convert num(http_req_result) as http_res | where http_res &gt; 0 | rename http_res as "RequestStatus", request.body{}.value.request.endpoint as Endpoint | regex Endpoint="^\W\D+\w.\D+" | rex field=Endpoint "(?&lt;ep&gt;\/\w+\/\w+\/\w+)" | stats count(eval(RequestStatus&gt;0)) as total, count(eval(RequestStatus&gt;200)) as errors by ep | eval disponibilidad=(100-(errors/total*100)) | eval disponibilidad = round(disponibilidad,0) | rename ep as Endpoint | table Endpoint, disponibilidad | sort disponibilidad </CODE></PRE> Wed, 05 Feb 2020 17:50:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-an-endpoint-until-certain-value-and-not-the/m-p/462297#M130319 richgalloway 2020-02-05T17:50:27Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-an-endpoint-until-certain-value-and-not-the/m-p/462298#M130320 <P>It worked perfectly thanks, is this still doing something in the search "| regex Endpoint="^\W\D+\w.\D+" ? because I tried this regular expression and worked but didn't cut the rest of the endpoint like yours did, "| rex field=Endpoint "(?\/\w+\/\w+\/\w+)", can you break it down for me en explain it? thank you so much</P> Wed, 05 Feb 2020 18:17:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-an-endpoint-until-certain-value-and-not-the/m-p/462298#M130320 dnavia29 2020-02-05T18:17:12Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-an-endpoint-until-certain-value-and-not-the/m-p/462299#M130321 <P>The <CODE>regex</CODE> command is a filter. It merely allows or blocks events based on the provided regular expression.<BR /> The <CODE>rex</CODE> command is for field extraction ("cutting"). It also uses regular expressions, but any named capture groups in the regex become fields in the event.</P> Wed, 05 Feb 2020 19:53:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-an-endpoint-until-certain-value-and-not-the/m-p/462299#M130321 richgalloway 2020-02-05T19:53:29Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-an-endpoint-until-certain-value-and-not-the/m-p/462300#M130322 <P>Ok I understand, thank you so much for your help </P> Wed, 05 Feb 2020 20:24:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-an-endpoint-until-certain-value-and-not-the/m-p/462300#M130322 dnavia29 2020-02-05T20:24:20Z