Dashboards & Visualizations

display selected urls in the output which has nonzero values

sahil237888
Path Finder

Hi Team,

 

Can you help as I want only selected url's to display in my query output.

index=dev_env sourcetype="urldata" URL ="*" LoadTime="*"
| timechart span=1m eval(round(avg(LoadTime),0)) as TimeUsedtoload by URL
| fields + _time "https://www.pingtest.com/Logins/Login.aspx?testid=1578&actid=21047https://www.pingtest.com/*/testing.aspx"   "https://www.othertest.com/Logins/*.aspx"


The output includes all the URL's like -

_time     https://www.servermonitor/server.aspx?filetype_id=474&mode=new       https://www.pingtest.com/Testdata.aspx     https://www.pingtest.com/Logins/Login.aspx?testid=1578&actid=21047     and_other_multipleurls

I want to display only URL's which are like " https://www.pingtest.com/Logins/Login.aspx?testid=1578&actid=21047" " https://www.pingtest.com/Logins/Login.aspx" " https://www.othertest.com/Logins/Login.aspx?testid=1578&"

and from above which are having not null values.

 

 

Labels (1)
0 Karma

niketn
Legend

@sahil237888 you should filter URLs upfront while pulling from index (Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Search/Quicktipsforoptimization) . So if you are interested only in specific URLs you should add them to first SPL i.e.

index=dev_env sourcetype="urldata" URL IN ("https://www.pingtest.com/Logins/Login.aspx*","https://www.othertest.com/Logins/Login.aspx*") 
| timechart span=1m eval(round(avg(LoadTime),0)) as TimeUsedtoload by URL

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

add before stats

 

| where ( match(URL,"https://www.pingtest.com/<rest of static URL>%) AND match(URL, "<your Second static URL>%"))

 

and add there as many match part as needed.
r. Ismo 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...