regex for uri ignoring query params and path params.

donB — Tue, 26 Jan 2021 05:20:35 GMT

I am trying to find the top api url's that were consumed by our clients. Our uri in logs are of below format.

1. https://api.server.com/user/1 (type 1)
2. https://api.server.com/user/2 (type 1)
3. https://api.server.com/user/3/role/1 (type 2)
4 . https://api.server.com/user?name=test (type 3)

Now i need result count for each uri like below.

/user/{id} - 2

/user/{id}/role{id}. - 1

/user - 1 (or user {filter} for query params e.g. /user/{filter})

i have unlimited combinations of such path parameters for different resources. what is the best way to get the count of url hits.

Re: regex for uri ignoring query params and path params.

ITWhisperer — Tue, 26 Jan 2021 11:43:39 GMT

Without the full log entry or an example of the fields already extracted, I will have to guess that the url is either enclosed in double quotes or there is a trailing space of some kind and that the ids are all a series of digits

| rex "(?P<uri>https:\/\/api\.server\.com\/[^\?\"\s]+)" | rex field=uri mode=sed max_match=0 "s/\/[\d]+/\/\{id\}/" | stats count by uri

topic regex for uri ignoring query params and path params. in Splunk Search

regex for uri ignoring query params and path params.

Re: regex for uri ignoring query params and path params.