Splunk Search

How to find Web url length

hartfoml
Motivator

I was told i could find command info in url buy finding the url's that are 2.5 times longer than the average length. I think i know how to do the sub search but i don't know how to find the url length. Can anyone help?

Tags (1)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

In your search just do: foo_search | eval url_length = len(url) | more_things.

If you wanted to find the avg over a time period you would do:

sourcetype=access_combined | eval url_length = len(url) | stats avg(url_length)

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

In your search just do: foo_search | eval url_length = len(url) | more_things.

If you wanted to find the avg over a time period you would do:

sourcetype=access_combined | eval url_length = len(url) | stats avg(url_length)

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...