topic Re: I need to split the requestPath eliminating the data in Splunk Search

I need to split the requestPath eliminating the data

vijaysubramania — Wed, 24 Jun 2020 17:47:05 GMT

Hi,

Need one Help. I have the below mentioned requestPath where I am able to capture the whole path..But can't take a count if there is different Div ID and Account No. I just to extract only
"/ecp/stream/v1/purchase/" and make a count of it. so that I can get the different response status

"requestPath":"/ecp/stream/v1/purchase/NTX.8160/8260180902213447","responseStatus":204,"responseSize":0,"responseContent":"","responseTime":27} Show syntax highlighted

rex field=_raw "requestPath":"(?<reqPath>[^?|^\s|^"]+)"

Re: I need to split the requestPath eliminating the data

richgalloway — Wed, 24 Jun 2020 18:39:32 GMT

Try this regex.

... | rex "requestPath":"(?<reqPath>(?:\/[^\/]+){4})"

Re: I need to split the requestPath eliminating the data

vijaysubramania — Thu, 25 Jun 2020 05:38:14 GMT

Thanks Rich..I tried the option you gave me. but it's didn't display the request Path nor trimmed it.

My Search "requestPath":"/ecp/stream/v1/purchase*" | rex "requestPath":"(?<reqPath>(?:\/[^\/]+){4})" | stats count by reqPath.

I can see the events but it's not extracting

Re: I need to split the requestPath eliminating the data

yeahnah — Thu, 25 Jun 2020 05:55:57 GMT

Hi @vijaysubramania

The answer provided by @richgalloway is mostly correct but you'll need to backslash escape the double quotes. Here's a run anywhere example of what I mean.

| makeresults | eval _raw="requestPath\":\"/ecp/stream/v1/purchase/NTX.8160/8260180902213447" | rex "requestPath\":\"(?<reqPath>(?:\/[^\/]+){4})" | stats count by reqPath

Hope this helps.

Re: I need to split the requestPath eliminating the data

vijaysubramania — Thu, 25 Jun 2020 22:56:48 GMT

Got it..Thank you very much Rich and Yeahnah 🙂