topic Re: Different values of parameters in Splunk Search

Different values of parameters

xvxt006 — Thu, 29 May 2014 20:26:34 GMT

Hi,

I have below variations of uri patterns for a particular functionality. i want to list out query string parameters and their values separately (in a tabular format or any other format).

Say for example

For q
value count
XXX 5
YYY 3

i tried to use rex and extract fileds (q, Index, items, country, lan) but as the uri formats are in different right boundaries (for example q has right boundary & in 1st and 2nd uri pattern but i the 3rd it has no &). So how do we deal with these kind of situations?

Uri formats:

/perform?q=XXX&Index=XXX&items=XXX
/perform?q=XXX&Index=XXX&items=XXX&account=&country=XXX&lan=XXX
/perform?q=YYY
/perform?q=YYY&account=XXX
/perform?q=YYY&Index=XXX&items=XXX&account=XXX&country=XXX&lan=XXX
/perform?q=XXX&account=XXX&items=XXX
/perform?q=XXX&account=XXX&country=XXX
/perform?q=XXX&Index=XXX&items=XXX
/perform?q=XXX&account=XXX&Index=XXX&items=XXX

Re: Different values of parameters

somesoni2 — Thu, 29 May 2014 20:41:37 GMT

Try this

<<your base search giving field uri >>| rex field=uri "q=(?<q>.*)" | eval q="a=".q | rex field=q max_match=0 "(\w+=)+(?<value>[^&]+)" | mvexpand value | stats count by value

Update:

 <<your base search giving field uri >> | rex field=uri "q=(?<q>.*)" | eval q="q=".q | rex field=q max_match=0 "(?<key>\w+)=(?<value>[^&]+)" | eval temp=mvzip(key,value) | mvexpand temp | rex field=temp "(?<key>.*),(?<value>.*)" | stats count by key,value | stats list(count) list(value) by key

Re: Different values of parameters

xvxt006 — Sun, 01 Jun 2014 20:45:31 GMT

Hi, if i understand it correctly, you are getting the query string into q and i did not get why you have eval q="a=".q and then you are taking that result and you are trying to separate the values using & and you have max_match=0 as it has multi value field?

Re: Different values of parameters

xvxt006 — Sun, 01 Jun 2014 21:06:56 GMT

i have tried the query and it is giving me all the value but it is not separating by each key. Meaning for q these are all the values, account these are all the values, index these are all the values, etc

Re: Different values of parameters

somesoni2 — Tue, 03 Jun 2014 21:13:27 GMT

Try the updated answer.