topic Re: Combine two values from the same field in Splunk Search

How to combine two values from the same field?

msarkaus — Tue, 25 Oct 2022 14:03:22 GMT

I'm trying to combine two simular values from the same field. and rename the values.

Splunk pic2.png

I would like to combine /v1/product and /v1/product/ and rename it Product API

Search String:

| stats count by urlPthTxt

I did try a few different commands but didn't work. Please help.

Thanks

gcusello — Tue, 25 Oct 2022 13:42:35 GMT

if the structure of your field is always: /string/string and changes only for the last slash, you could use a regex like this:

<your_search> | rex field=urlPthTxt "^(?<urlPthTxt_new>\/\w+\/\w+)"

Ciao.

Giuseppe