https://community.splunk.com/t5/Splunk-Search/How-to-get-different-URIs-in-different-fields-using-eval-command/m-p/324899#M96913 <P>@gibbs.. You should convert your comment as answer and accept the same.</P> Thu, 13 Apr 2017 06:46:54 GMT niketn 2017-04-13T06:46:54Z https://community.splunk.com/t5/Splunk-Search/How-to-get-different-URIs-in-different-fields-using-eval-command/m-p/324892#M96906 <P>I have a URI field that contains call to different APIs like:</P> <PRE><CODE><A href="http://mydomain.com/A/v1/*" target="test_blank">http://mydomain.com/A/v1/*</A> <A href="http://mydomina.com/B/v1/*" target="test_blank">http://mydomina.com/B/v1/*</A> <A href="http://mydomina.com/C/v1/*" target="test_blank">http://mydomina.com/C/v1/*</A> </CODE></PRE> <P>How can i use Splunk, maybe eval, to store calls to an API in a variable, B in another variable and so on?</P> Tue, 11 Apr 2017 19:05:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-different-URIs-in-different-fields-using-eval-command/m-p/324892#M96906 gibbs 2017-04-11T19:05:42Z https://community.splunk.com/t5/Splunk-Search/How-to-get-different-URIs-in-different-fields-using-eval-command/m-p/324893#M96907 <P>Do you want to create a new field which contain the value A, B, C etc from the URI??</P> Tue, 11 Apr 2017 20:06:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-different-URIs-in-different-fields-using-eval-command/m-p/324893#M96907 somesoni2 2017-04-11T20:06:14Z https://community.splunk.com/t5/Splunk-Search/How-to-get-different-URIs-in-different-fields-using-eval-command/m-p/324894#M96908 <P>Hey,</P> <P>I used to mvfilter along with match to get this.</P> <P>I wanted separate fields for A,B, C..... Is there any other way to do this?</P> Tue, 11 Apr 2017 20:49:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-different-URIs-in-different-fields-using-eval-command/m-p/324894#M96908 gibbs 2017-04-11T20:49:27Z https://community.splunk.com/t5/Splunk-Search/How-to-get-different-URIs-in-different-fields-using-eval-command/m-p/324895#M96909 <P>What do you mean when you say "to store calls"? </P> <P>Storing the fact that you made a call, or storing the language for the call itself, or something else?</P> Tue, 11 Apr 2017 21:17:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-different-URIs-in-different-fields-using-eval-command/m-p/324895#M96909 DalJeanis 2017-04-11T21:17:52Z https://community.splunk.com/t5/Splunk-Search/How-to-get-different-URIs-in-different-fields-using-eval-command/m-p/324896#M96910 <P>There may be, depending upon the what the final output that you to achieve. If you just want to add a separate field with those values without any reporting command that your eval is the way to go. If you're creating some other report, there might be other ways. If you could share your search/requirement/mock output, we can have a look.</P> Tue, 11 Apr 2017 21:18:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-different-URIs-in-different-fields-using-eval-command/m-p/324896#M96910 somesoni2 2017-04-11T21:18:08Z https://community.splunk.com/t5/Splunk-Search/How-to-get-different-URIs-in-different-fields-using-eval-command/m-p/324897#M96911 <P>@gibbs what does the event data look like. Can you add a mock? Also like somesoni2 asked... what is your use case once you get API calls as url extracted in a field?</P> Wed, 12 Apr 2017 04:00:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-different-URIs-in-different-fields-using-eval-command/m-p/324897#M96911 niketn 2017-04-12T04:00:33Z https://community.splunk.com/t5/Splunk-Search/How-to-get-different-URIs-in-different-fields-using-eval-command/m-p/324898#M96912 <P>Hi All,</P> <P>I wanted to plot a time chart of the count of requests hitting different APIs. This worked for me.</P> <P>source="<EM>" earliest=-1@d | <BR /> eval aRequests=mvfilter(match(request_uri,"<A href="http://mydomain.com/A/v1/" target="_blank">http://mydomain.com/A/v1/</A></EM>")) |<BR /> eval bRequests=mvfilter(match(request_uri,"<A href="http://mydomain.com/B/v1/*%22)" target="_blank">http://mydomain.com/B/v1/*")</A>) |<BR /> eval cRequests=mvfilter(match(request_uri,"<A href="http://mydomain.com/C/v1/*%22%22)" target="_blank">http://mydomain.com/C/v1/*"")</A>) |<BR /> timechart count(aRequests) count(bRequests) count(cRequests) </P> Tue, 29 Sep 2020 13:38:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-different-URIs-in-different-fields-using-eval-command/m-p/324898#M96912 gibbs 2020-09-29T13:38:58Z https://community.splunk.com/t5/Splunk-Search/How-to-get-different-URIs-in-different-fields-using-eval-command/m-p/324899#M96913 <P>@gibbs.. You should convert your comment as answer and accept the same.</P> Thu, 13 Apr 2017 06:46:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-different-URIs-in-different-fields-using-eval-command/m-p/324899#M96913 niketn 2017-04-13T06:46:54Z https://community.splunk.com/t5/Splunk-Search/How-to-get-different-URIs-in-different-fields-using-eval-command/m-p/324900#M96914 <P>Hi All,</P> <P>I wanted to plot a time chart of the count of requests hitting different APIs. This worked for me.</P> <PRE><CODE>source="*" earliest=-1@d | eval aRequests=mvfilter(match(request_uri,"http://mydomain.com/A/v1/*")) | eval bRequests=mvfilter(match(request_uri,"http://mydomain.com/B/v1/*")) | eval cRequests=mvfilter(match(request_uri,"http://mydomain.com/C/v1/*"")) | timechart count(aRequests) count(bRequests) count(cRequests) </CODE></PRE> Thu, 13 Apr 2017 18:50:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-different-URIs-in-different-fields-using-eval-command/m-p/324900#M96914 gibbs 2017-04-13T18:50:32Z