Splunk Search

In a search, how do you group similar URL patterns?

alex129
New Member

I am doing a search and evaluating count, avg RT based on some URL patterns. Below are the URLs for my category pages :

//Food/Back-to-School/Breakfast/Breakfast-Bars/c/1015001004
//Food/Back-to-School/Breakfast/Cereal/c/1015001001
//Home-%26-Lifestyle/Beauty/Cosmetics/Eyes/c/2004001001

Using below query gives me the different results for different URLs, but I want results grouped into 1 Relative URL.

sourcetype=apache:access request_uri="\*/c/\*"  |  search apache_responsetime=* | chart perc90(apache_responsetime) over request_uri

What query I should use to get desired results?

0 Karma

burwell
SplunkTrust
SplunkTrust

So I recommend creating a new field which normalizes the request uris. Also you don't need a separate search apache_responsetime=*. Just combine it. The default is to AND the searches.

It is not clear what the space of your URLs is. If you want to lump all Food and all Home life style pages together then maybe something like:

 sourcetype=apache:access request_uri="\*/c/\*"  apache_responsetime=* | rex field=request_uri "//(?<category>\S+)/" | chart perc90(apache_responsetime) by category
0 Karma

alex129
New Member

@burwell

Your query is grouping all URLs post '/c/' i.e.

/Food/Back-to-School/Breakfast/Breakfast-Bars/c/1015001001
/Food/Back-to-School/Breakfast/Breakfast-Bars/c/1015001002
/Food/Back-to-School/Breakfast/Breakfast-Bars/c/1015001003

into 

/Food/Back-to-School/Breakfast/Breakfast-Bars/c/

I need all URLs before /c/ as well to group into 1 URL

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Since you're looking at only specific type of URIs (only one pattern), you can simply do something like this

sourcetype=apache:access request_uri="\*/c/\*"  apache_responsetime=* 
| stats perc90(apache_responsetime)  | eval request_uri="*/c/*" | table requiest_uri perc90(apache_responsetime)

A more generic approach would be this (where you can look for multiple URI patterns)

sourcetype=apache:access (request_uri="\*/a/\*" OR   request_uri="\*/b/\*" OR...other patterns ) apache_responsetime=* 
| eval request_uri=case(searchmatch(request_uri="\*/a/\*"),"*/a/*", request_uri="\*/b/\*"),"*/b/*",..literal/static values for other patterns..)
| chart perc90(apache_responsetime) over request_uri
0 Karma

alex129
New Member

@somesoni2 ,

Your 1st query, I am getting the results for 90th percentile in 1 column, But
1. Not getting chart over time for grouped URL
2. how to get stats count for all these URLs

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@alex129, Can you explain with example what do you mean by similar url?

0 Karma

alex129
New Member

@VatsalJagani , the URLs mentioned in my questions are for category page & can be searched as requesturi="/c/"

0 Karma

burwell
SplunkTrust
SplunkTrust

So if they have /c/ they are the same? What are other url patterns?

0 Karma

alex129
New Member

@burwell
I mean "/c/" is common in all category URLs and I need to group all these URLs so that I can get count, response time etc. for grouped URL

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...