https://community.splunk.com/t5/Splunk-Search/Organizing-Filtering-URL-results/m-p/101759#M26292 <P>Hint : You may need to use rex field extractions functions or eval functions (like case) to filter your uri_stem and normalize them. <BR /> see <A href="http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Rex">http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Rex</A></P> <P>If you want help, please provide a sample and a clear idea of the expected result.</P> Wed, 16 Oct 2013 16:15:11 GMT yannK 2013-10-16T16:15:11Z https://community.splunk.com/t5/Splunk-Search/Organizing-Filtering-URL-results/m-p/101758#M26291 <P>host=server sourcetype=iis #Software NOT #Fields NOT /favicon.ico <BR /> (method=GET OR method=POST) NOT eventtype="web-imagefile"<BR /> | fillnull <BR /> | stats count first(_time) last(_time) by user,src_ip,uri_stem</P> <P>I am trying to approach organizing/filtering the uri_stem results to return just the information that seems useful. I see functions for eval and command but am not sure of the best way to approach.</P> <P>Thanks!</P> Mon, 28 Sep 2020 14:59:26 GMT https://community.splunk.com/t5/Splunk-Search/Organizing-Filtering-URL-results/m-p/101758#M26291 wrays 2020-09-28T14:59:26Z https://community.splunk.com/t5/Splunk-Search/Organizing-Filtering-URL-results/m-p/101759#M26292 <P>Hint : You may need to use rex field extractions functions or eval functions (like case) to filter your uri_stem and normalize them. <BR /> see <A href="http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Rex">http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Rex</A></P> <P>If you want help, please provide a sample and a clear idea of the expected result.</P> Wed, 16 Oct 2013 16:15:11 GMT https://community.splunk.com/t5/Splunk-Search/Organizing-Filtering-URL-results/m-p/101759#M26292 yannK 2013-10-16T16:15:11Z https://community.splunk.com/t5/Splunk-Search/Organizing-Filtering-URL-results/m-p/101760#M26293 <P>/fraudintro.html<BR /> /fraudmenu.htm<BR /> /fraudpost.asp<BR /> /fraudview.asp</P> <P>Out of the results I am getting in the uri_stem column, I would like to learn the ability to either see just these result or completely exclude them.</P> Wed, 16 Oct 2013 16:30:57 GMT https://community.splunk.com/t5/Splunk-Search/Organizing-Filtering-URL-results/m-p/101760#M26293 wrays 2013-10-16T16:30:57Z https://community.splunk.com/t5/Splunk-Search/Organizing-Filtering-URL-results/m-p/101761#M26294 <P>to see them<BR /> <CODE>uri_stem=*/fraud*"</CODE></P> <P>to exclude them<BR /> <CODE>NOT uri_stem=*/fraud*"</CODE></P> Wed, 16 Oct 2013 18:05:43 GMT https://community.splunk.com/t5/Splunk-Search/Organizing-Filtering-URL-results/m-p/101761#M26294 yannK 2013-10-16T18:05:43Z