topic How can i get only one data on column table instead of having multiple due to params? in Splunk Search

How can i get only one data on column table instead of having multiple due to params?

DougiieDee — Fri, 13 Aug 2021 17:00:29 GMT

operationName	urls	avg_time	max_time	count
MethodUsingGET	https://www.google.com/api/v1/571114808/CAR.202 https://www.google.com/api/v1/571114899	3255	3255	2
UsingGET	https://www.googleA.com/api/v1/571114888/api/ https://www.googleB.com/api/v1/571114877 /api/	1316.889	5345	18

I would only want one url but it should count others as well. Is there a way?

Re: How can i get only one data on column table instead of having multiple due to params?

ITWhisperer — Fri, 13 Aug 2021 17:13:36 GMT

What search did you use to get these results? What do your events look like?

Re: How can i get only one data on column table instead of having multiple due to params?

DougiieDee — Fri, 13 Aug 2021 17:36:09 GMT

index=*
| rex "(?i)\".*?\":(?P<operationId>\d+)(?=,)"
| rex "(?i)\".*?\":(?P<responseTime>\d+)(?=,)"
| rex "(?i)\".*?\":(?P<Url>\d+)(?=,)"
| stats values(Url) as urls, avg(responseTime) as avg_time, max(responseTime) as max_time, count by operationId

The results are in pretty in splunk but when i download the csv file all the results are in like 1 line and doesnt have data like it showed

Re: How can i get only one data on column table instead of having multiple due to params?

ITWhisperer — Fri, 13 Aug 2021 17:47:47 GMT

Try something this

| stats avg(responseTime) as avg_time, max(responseTime) as max_time, count by operationId, Url

Re: How can i get only one data on column table instead of having multiple due to params?

DougiieDee — Fri, 13 Aug 2021 18:31:44 GMT

the results are like this

operationId	Url	avg_time	max_time	count
accountUsingGET	https://*/api/account/history/sourceaccount	1675.33333	4914	3
accountUsingGET	https://*/api/account/history/sourceaccount	1324.7	5345	10
LineUsingPOST	https://*/api/lines/1012/activate	1224	1224	1
LineUsingPOST	https://*/api/lines/1014/activate	1015	1015	1
LineUsingPOST	https://*/api/lines/1017/activate	1506	1015	1

but i only want one data from operationId and Url but it should count all and give avg response time as well, like this, is there a way?

operationId	Url	avg_time	max_time	count
accountUsingGET	https://*/api/account/history/sourceaccount	1675.33333	4914	13
LineUsingPOST	https://*/api/lines/1012/activate	1224	1224	3

Re: How can i get only one data on column table instead of having multiple due to params?

ITWhisperer — Fri, 13 Aug 2021 20:49:27 GMT

I don't think so - if you do stats by operationId, Url you will only get one row for each unique combination of these fields, which is what you said you wanted.