Hello Everyone,
With the below query
<my_search_index>
| spath uri | search uri="/vehicle/orders/v1" OR uri="/vehicle/orders/v1*/validate" OR uri="/vehicle/orders/v1*/process" OR uri="/vehicle/orders/v1*/processInsurance"
| eval Operations=case(
searchmatch("/vehicle/orders/v1*/processInsurance"),"processInsurance",
searchmatch("/vehicle/orders/v1/*/validate"),"validateOrder",
searchmatch("/vehicle/orders/v1/*/process"),"processOrder",
searchmatch("/vehicle/orders/v1"),"createOrder")
| stats count as hits avg(request_time) as average perc90(request_time) as response90 by Operations
| eval average=round(average,2),response90=round(response90,2)
I am able to construct the table:
Apart from the 4 url patterns mentioned in query I need to include following url pattern for getOrder
uri: /vehicle/orders/v1/dbd20er9-g7c3-4e71-z089-gc1ga8272179
from the raw splunk log
{
"request_timestamp ": "02/Jan/1984:09:05:04",
"response_timestamp": "01/Jan/1984:09:05:04 +0000",
"kong_request_id": "my_kong_req_id",
"ek-correlation-id": "my_corr_id",
"ek-request-id": "my_req_id",
"ek-transaction-id": "",
"req_id": "",
"channel_name": "",
"logType": "kong",
"traceparent": "0traceparent",
"request_method": "GET",
"remote_addr": "1.2.3.4",
"server_addr": "5.5.6.6",
"scheme": "https",
"host": "my.host.com",
"status": 200,
"request_method": "GET",
"uri": "/vehicle/orders/v1/dbd20er9-g7c3-4e71-z089-gc1ga8272179",
"server_protocol": "HTTP/1.1",
"bytes_sent": 23663,
"body_bytes_sent": 23547,
"request_length": 1367,
"http_referer": "-",
"http_user_agent": "-",
"request_time": "0.010",
"upstream_response_time": "0.008",
"upstream_addr": "1.3.5.7",
"http_content_type": "application/json",
"upstream_host": "my.host.com"
}
Not sure how do I change my query to include the required url pattern. If I try this: /vehicle/orders/v1/* or /vehicle/orders/v1/*-*-*-*-*
it might include the count of below patterns as well:
/payment/orders/v1*/processInsurance
/payment/orders/v1/*/validate
/payment/orders/v1/*/process
/payment/orders/v1
Appreciate your help.
OK Assuming there are no more typos in your examples, try something like this
<my_search_index>
| spath uri
| regex uri="\/vehicle\/orders\/v1(|.*\/processInsurance|\/.*\/validate|\/.*\/validateInsurance|\/.*\/process|\/([^-]+-){4}[^-]+)$"
| eval Operations=case(
match(uri,"/vehicle/orders/v1/.*/processInsurance"),"processInsurance",
match(uri,"/vehicle/orders/v1/.*/validateInsurance"),"validateInsurance",
match(uri,"/vehicle/orders/v1/.*/validate"),"validateOrder",
match(uri,"/vehicle/orders/v1/.*/process"),"processOrder",
match(uri,"/vehicle/orders/v1/[^-]*-[^-]*-[^-]*-[^-]*-[^-]*"),"getOrder",
match(uri,"/vehicle/orders/v1"),"createOrder")
| stats count as hits avg(request_time) as average perc90(request_time) as response90 by Operations
| eval average=round(average,2),response90=round(response90,2)
Try something like this
<my_search_index>
| spath uri
| regex uri="\/vehicle\/orders\/v1(.*\/processInsurance|\/.*\/validate|\/.*\/process|\/([^-]+-){4}[^-]+)$"
| eval Operations=case(
searchmatch("/vehicle/orders/v1*/processInsurance"),"processInsurance",
searchmatch("/vehicle/orders/v1/*/validate"),"validateOrder",
searchmatch("/vehicle/orders/v1/*/process"),"processOrder",
searchmatch("/vehicle/orders/v1/*-*-*-*-*"),"getOrder",
searchmatch("/vehicle/orders/v1"),"createOrder")
| stats count as hits avg(request_time) as average perc90(request_time) as response90 by Operations
| eval average=round(average,2),response90=round(response90,2)
Thanks @ITWhisperer
with your splunk query currently I am able to list below url pattern only
/vehicle/orders/v1/dbd20er9-g7c3-4e71-z089-gc1ga8272179
/vehicle/orders/v1/*/processInsurance
/vehicle/orders/v1/*/validateInsurance
/vehicle/orders/v1/*/validate
/vehicle/orders/v1/*/process
I missed to include 1 more pattern.
/vehicle/orders/v1 (new one)
Please help. Thanks in advance
OK Assuming there are no more typos in your examples, try something like this
<my_search_index>
| spath uri
| regex uri="\/vehicle\/orders\/v1(|.*\/processInsurance|\/.*\/validate|\/.*\/validateInsurance|\/.*\/process|\/([^-]+-){4}[^-]+)$"
| eval Operations=case(
match(uri,"/vehicle/orders/v1/.*/processInsurance"),"processInsurance",
match(uri,"/vehicle/orders/v1/.*/validateInsurance"),"validateInsurance",
match(uri,"/vehicle/orders/v1/.*/validate"),"validateOrder",
match(uri,"/vehicle/orders/v1/.*/process"),"processOrder",
match(uri,"/vehicle/orders/v1/[^-]*-[^-]*-[^-]*-[^-]*-[^-]*"),"getOrder",
match(uri,"/vehicle/orders/v1"),"createOrder")
| stats count as hits avg(request_time) as average perc90(request_time) as response90 by Operations
| eval average=round(average,2),response90=round(response90,2)
Thanks once again @ITWhisperer It works as expected.