Getting Data In

Aggregating uri_paths with unique value


Hi all

I am using Splunk to gather info on usage and performance of various web applications . I am interested to know how many times certain http transactions are performed over a timeframe and what the average, min and max response times are for each transaction. I can run a query like ..

index=arena_repairs_uat | stats count avg(responseTime) BY uri_path

and this gives me a pretty good report aggregating all the different types of http request with the number of times it was sent and the average response time.

However some of the http requests have a dynamic unique repair id value in them such as ...


I want to tell the search to ignore the unique repair id and treat these as the same type of request. With the above request it treats these as separate request types.

I know I can do a search like ..

index=arena_repairs_uat uri_path="/arena/repair/motor/*/addNewQuoteForEachRepairer.ajax"

to group all these requests together in a single search but I need to incorporate this in the initial search that gets info on all request types and their count and average response times.

Any help would be much appreciated.

Tags (2)
0 Karma


Thanks jonuwz for the quick response. That works perfectly. Cheers.

0 Karma


You can strip out the numbers with rex mode=sed like this :

... | rex field=uri_path mode=sed "s/repair\/motor\/[0-9]+/repair\/motor/"

assuming the repair id is always just numbers

Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...