https://community.splunk.com/t5/Splunk-Search/Query-for-Multiple-URLs/m-p/502229#M139791 <P>I'm sure this will be easy for you guys but I"m struggling with it..<BR /> I need to modify this query to look for both the <A href="http://open/FinalNumbers">http://open/FinalNumbers</A> as well as a URL of <A href="https://apicorp.company/open/FinalNumbers">https://apicorp.company/open/FinalNumbers</A></P> <P>"A GET was made to Open API - Status: OK (<A href="http://open/FinalNumbers">http://open/FinalNumbers</A>" | spath AppID | search Environment=prod | timechart count by Environment | bin span=7d _time | stats avg(prod)</P> <P>Please help!</P> Fri, 06 Dec 2019 12:16:09 GMT kvanwagoner 2019-12-06T12:16:09Z https://community.splunk.com/t5/Splunk-Search/Query-for-Multiple-URLs/m-p/502229#M139791 <P>I'm sure this will be easy for you guys but I"m struggling with it..<BR /> I need to modify this query to look for both the <A href="http://open/FinalNumbers">http://open/FinalNumbers</A> as well as a URL of <A href="https://apicorp.company/open/FinalNumbers">https://apicorp.company/open/FinalNumbers</A></P> <P>"A GET was made to Open API - Status: OK (<A href="http://open/FinalNumbers">http://open/FinalNumbers</A>" | spath AppID | search Environment=prod | timechart count by Environment | bin span=7d _time | stats avg(prod)</P> <P>Please help!</P> Fri, 06 Dec 2019 12:16:09 GMT https://community.splunk.com/t5/Splunk-Search/Query-for-Multiple-URLs/m-p/502229#M139791 kvanwagoner 2019-12-06T12:16:09Z https://community.splunk.com/t5/Splunk-Search/Query-for-Multiple-URLs/m-p/502230#M139792 <P>Sounds like you want to OR the URLs:</P> <PRE><CODE>"A GET was made to Open API - Status: OK (http://open/FinalNumbers" OR "A GET was made to Open API - Status: OK (https://apicorp.company/open/FinalNumbers" | spath AppID | search Environment=prod | timechart count by Environment | bin span=7d _time | stats avg(prod) </CODE></PRE> <P>Also before the first pipe, you should specify an index and sourcetype at a minimum for efficiency.</P> Fri, 06 Dec 2019 15:02:18 GMT https://community.splunk.com/t5/Splunk-Search/Query-for-Multiple-URLs/m-p/502230#M139792 jpolvino 2019-12-06T15:02:18Z https://community.splunk.com/t5/Splunk-Search/Query-for-Multiple-URLs/m-p/502231#M139793 <P>Thanks! That worked!</P> Fri, 06 Dec 2019 20:49:51 GMT https://community.splunk.com/t5/Splunk-Search/Query-for-Multiple-URLs/m-p/502231#M139793 kvanwagoner 2019-12-06T20:49:51Z https://community.splunk.com/t5/Splunk-Search/Query-for-Multiple-URLs/m-p/502232#M139794 <P>Please "accept as answer" the solution that fixes the issue, to help others. Thanks, and glad it worked!</P> Fri, 06 Dec 2019 21:16:23 GMT https://community.splunk.com/t5/Splunk-Search/Query-for-Multiple-URLs/m-p/502232#M139794 jpolvino 2019-12-06T21:16:23Z