topic Re: How do i get the url without params in Splunk Search

How do i get the url without params

mikeyty07 — Wed, 30 Jun 2021 00:16:16 GMT

I am trying to make a report based on the url, and avg response that certain url is taking. I am able to get the logs but wanted specifically without the params so i can have how many response time certain url is making. Below is the sample eg:
I can see the data like this but it creates multiple data
https://abc-google.com/ABC/abc/1234/abc

like this and i want only data from one url

https://abc-google.com/ABC/abc/1342/abc

which could remove the params and show something like this

https://abc-google.com/ABC/abc/{num}/abc

there are many url like this

https://abc-google.com/CDE/abc/cde/abc/cde/111

Is it possible to get all the data without params and have average response time on it?

Re: How do i get the url without params

venkatasri — Wed, 30 Jun 2021 00:41:09 GMT

Hi @mikeyty07

Unless you have all list of all url's and what's the dynamic portion/params of eacjh url it's really hard achieving your requirement. if you have that list | rex mode=sed is the way to replace dynamic portion to something like {param} and apply stats on top of it to gather avg etc..

---

An upvote would be appreciated if it helps!

Re: How do i get the url without params

mikeyty07 — Wed, 30 Jun 2021 00:47:11 GMT

how about if there is ID name(which is one unique name), instead of the url(because it contains other params as well for the same url) and based on the ID it display the avg time for other IDs as well with url displaying only params in it for other unique IDs as well?

Re: How do i get the url without params

venkatasri — Wed, 30 Jun 2021 00:48:41 GMT

@mikeyty07 That might work can you post samples of ID's how they looks like?

Re: How do i get the url without params

mikeyty07 — Wed, 30 Jun 2021 01:02:18 GMT

https://abc-google.com/ABC/abc/1342/abc ID-- getABC

https://abc-google.com/CDE/abc/cde/abc/cde/111 ID--postCDE
something like these

Re: How do i get the url without params

venkatasri — Wed, 30 Jun 2021 01:07:29 GMT

@mikeyty07 regex might not work can you post exact event samples, you can mask critical info when you post it. more the samples its better!

Re: How do i get the url without params

mikeyty07 — Wed, 30 Jun 2021 01:29:35 GMT

i am actually searching dbquery so it wont show raw events but shows only stats

https://abc.com/abc/api/cache	postApiCache	13
https://abc.com/abc-track	track	549
https://abc.com/bbc/api/apica	postCache	15
https://abc.com/til/api/api	ApiPOST	14
https://abc.com:443/efgh	efgs	382

Re: How do i get the url without params

venkatasri — Wed, 30 Jun 2021 01:49:24 GMT

@mikeyty07 naming the fields as url, Id, resp_time. Can you try following query?

<your_dbquery_goes_here> | stats values(url) as urls, avg(resp_time) as avg_time, max(resp_time) as max_time ,count by Id

---

An upvote would be appreciated and Accept solution if it helps!

Re: How do i get the url without params

mikeyty07 — Wed, 30 Jun 2021 02:25:52 GMT

Thank you!! this works perfectly