All Apps and Add-ons

Change search results for page counts

JohannesGmelin
Path Finder

Hey Community,

I need help with a custom search. At the moment I get a result looks like this:

/AuthorizationAdmin/javax.faces.resource/calendar.js.xhtml?ln=org.richfaces

But I need just the first word after the first slash without the other trash just like this:

/AuthorizationAdmin/

This is my search:

| tstats summariesonly=t count FROM datamodel=Web WHERE Web.site="*" "Web.eventtype"=pageview GROUPBY Web.uri | eventstats sum(count) as Total | eval percent = round((count/Total)*100,2) . "%" | fields - Total | rename percent AS "% Pageviews"

Thanks for your help!!!

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

| tstats summariesonly=t count FROM datamodel=Web WHERE Web.site="*" "Web.eventtype"=pageview GROUPBY Web.uri
| eventstats sum(count) as Total
| eval percent = round((count/Total)*100,2) . "%"
| fields - Total
| rename percent AS "% Pageviews"
| rex field=Web.uri mode=sed "s/^(\/[^\/]+\/).*$/\1/"

View solution in original post

woodcock
Esteemed Legend

Like this:

| tstats summariesonly=t count FROM datamodel=Web WHERE Web.site="*" "Web.eventtype"=pageview GROUPBY Web.uri
| eventstats sum(count) as Total
| eval percent = round((count/Total)*100,2) . "%"
| fields - Total
| rename percent AS "% Pageviews"
| rex field=Web.uri mode=sed "s/^(\/[^\/]+\/).*$/\1/"

JohannesGmelin
Path Finder

Great thank you! 🙂

I've tried this at the User User Journey Flow too (Landing Page) but no result 😕

Do you have any idea why?
The other problem is that I'm getting now 10 times a page for example like this: /admin/
because the ending is different but it should be just one entry for one page you understand?

Thanks a lot!

LG Johannes

0 Karma

woodcock
Esteemed Legend

Try this search: does it do what you expect?

| makeresults 
| eval Web.uri="/first/second/third/fourth" 
| rex field=Web.uri mode=sed "s/^(\/[^\/]+\/).*$/\1/"
0 Karma

JohannesGmelin
Path Finder

I've sent you an email with a picture for a better understanding. I'm not allowed to make this picture public 😕

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...