https://community.splunk.com/t5/Splunk-Search/Splunk-newbie-question/m-p/58920#M14491 <P>Yes. I tried your recommendation and I still get /Foobar/FoobarServices. I just want to capture Foobar.</P> Wed, 23 May 2012 20:09:33 GMT ncorchado 2012-05-23T20:09:33Z https://community.splunk.com/t5/Splunk-Search/Splunk-newbie-question/m-p/58918#M14489 <P>Given my apache access_log URI is /Foobar/FoobarServices, I want to extract Foobar only for my timechart. makemv delim="/" allowempty=t uri returns Foobar and FoobarServices. All I want is the Foobar. How do I do that?</P> <P>makemv delim="/" allowempty=t uri | timechart count by uri</P> <P>Thanks!</P> Wed, 23 May 2012 19:17:57 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-newbie-question/m-p/58918#M14489 ncorchado 2012-05-23T19:17:57Z https://community.splunk.com/t5/Splunk-Search/Splunk-newbie-question/m-p/58919#M14490 <P>Are you just trying to extract information between the / and create a new field?</P> <P>sourcetype="access_combined" | rex field=uri "^/(?<NEWFIELD>.+?)/"</NEWFIELD></P> <P>Something like this?</P> Wed, 23 May 2012 19:35:19 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-newbie-question/m-p/58919#M14490 dmaislin_splunk 2012-05-23T19:35:19Z https://community.splunk.com/t5/Splunk-Search/Splunk-newbie-question/m-p/58920#M14491 <P>Yes. I tried your recommendation and I still get /Foobar/FoobarServices. I just want to capture Foobar.</P> Wed, 23 May 2012 20:09:33 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-newbie-question/m-p/58920#M14491 ncorchado 2012-05-23T20:09:33Z https://community.splunk.com/t5/Splunk-Search/Splunk-newbie-question/m-p/58921#M14492 <P>Did you get a new field on the left called newfield with this information?</P> Wed, 23 May 2012 20:24:37 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-newbie-question/m-p/58921#M14492 dmaislin_splunk 2012-05-23T20:24:37Z https://community.splunk.com/t5/Splunk-Search/Splunk-newbie-question/m-p/58922#M14493 <P>Got it<BR /> sourcetype="access_combined" | rex field=uri "^/(?<JVM>.+?)/" | timechart count by JVM<BR /> Thanks!</JVM></P> Wed, 23 May 2012 21:47:56 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-newbie-question/m-p/58922#M14493 ncorchado 2012-05-23T21:47:56Z https://community.splunk.com/t5/Splunk-Search/Splunk-newbie-question/m-p/58923#M14494 <P>Cool, please accept the answer and select the up arrow then.</P> Wed, 23 May 2012 21:49:52 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-newbie-question/m-p/58923#M14494 dmaislin_splunk 2012-05-23T21:49:52Z