topic Re: Calculate traffic split based on URI prefix in Splunk Search

Calculate traffic split based on URI prefix

johntopley — Thu, 27 Mar 2014 11:58:51 GMT

Hi,

The traffic in our application is routed according to a URI prefix, for example: uri_path=/foo/* or uri_path=/bar/*. How can I produce a pie chart that simply shows the percentage of traffic that went to each uri_path?

Re: Calculate traffic split based on URI prefix

somesoni2 — Mon, 28 Sep 2020 16:14:54 GMT

If this field is extracted try this.

your base search | stats count by uri_path
or
your base search | chart count by uri_path

and use pie chart as visualisation.

Re: Calculate traffic split based on URI prefix

johntopley — Mon, 28 Sep 2020 16:14:57 GMT

Thanks, but uri_path contains numerous values. I need the grouping by uri_path prefix.

Re: Calculate traffic split based on URI prefix

somesoni2 — Mon, 28 Sep 2020 16:15:00 GMT

Then (based on your example, your just need first part of uri, '/foo' and '/bar'), try this.

your base search| rex field=uri_path "^(?.*)\/"| stats count by uri_prefix

Re: Calculate traffic split based on URI prefix

johntopley — Mon, 28 Sep 2020 16:15:03 GMT

I don't think that does what I need. I'm expecting two figures: one for all uri_paths that start with /foo and another for all uri_paths that start with /bar.

Re: Calculate traffic split based on URI prefix

somesoni2 — Mon, 28 Sep 2020 16:15:05 GMT

With the search "your base search| rex field=uri_path "^(?.*)/"", what values you're getting in the field uri_prefix?

Re: Calculate traffic split based on URI prefix

johntopley — Thu, 27 Mar 2014 15:14:15 GMT

I get > 100 different values for the uri_prefix field. Lots of different URLs that start with /foo or /bar.

Re: Calculate traffic split based on URI prefix

somesoni2 — Mon, 28 Sep 2020 16:15:08 GMT

It seems slashes were removed in the comment field. try this.

your base search| rex field=uri_path "^/(?[^/]*)"| stats count by uri_prefix

Re: Calculate traffic split based on URI prefix

johntopley — Thu, 27 Mar 2014 15:43:53 GMT

Thanks, but it still gives 100s of different values for uri_prefix instead of the two I want.

Re: Calculate traffic split based on URI prefix

somesoni2 — Mon, 28 Sep 2020 16:15:11 GMT

Try the updated search '| rex field=uri_path "^/(?[^/]*)"'. This gives 'bar' and 'foo' from the uri.

Re: Calculate traffic split based on URI prefix

johntopley — Fri, 28 Mar 2014 08:47:46 GMT

No, still the same.

Re: Calculate traffic split based on URI prefix

MuS — Fri, 28 Mar 2014 09:02:30 GMT

Hi johntopley,

try something like this:

... | rex field=uri_path max_match=0 "(?<uri_prefix>/[^/]+)" | ...

cheers, MuS

Re: Calculate traffic split based on URI prefix

johntopley — Fri, 28 Mar 2014 10:39:51 GMT

Thanks, but it gives 100s of different values for uri_prefix instead of the two I want.

Re: Calculate traffic split based on URI prefix

MuS — Fri, 28 Mar 2014 10:45:46 GMT

how about this:

your base search uri_path=/foo/* OR uri_path=/bar/* | rex field=uri_path max_match=0 "(?<uri_prefix>/[^/]+)" | dedup uri_prefix | ...

Re: Calculate traffic split based on URI prefix

johntopley — Fri, 28 Mar 2014 11:13:02 GMT

It doesn't group the requests into those that start with /foo/* and those that start with /bar/*.

Re: Calculate traffic split based on URI prefix

MuS — Fri, 28 Mar 2014 12:00:23 GMT

sure it will not group anything, because there is no stats nor any other command which will do that. So if you take the updated search and add a stats to it will that match your needs?

your base search uri_path=/foo/* OR uri_path=/bar/* | rex field=uri_path max_match=0 "(?<uri_prefix>/[^/]+)" | stats count by uri_prefix

I can only try to help and try to lead you, but I cannot write a complete search because I don't have your data....

Re: Calculate traffic split based on URI prefix

jdgifford — Mon, 28 Sep 2020 18:10:02 GMT

I have a similar situation and found MuS's proposed solution to point me in the right direction. I was getting multi-valued fields for my uri_prefix and discovered that max_match=0 seemed to be causing that. So, changing max_match=1 (the default) got me what I was looking for.

base_search | rex field=uri_path max_match=1 "(?<uri_prefix>/[^/]+)" | stats count by uri_prefix