parsing specific area of a field

[angelboshnakov]

Hello all,

just wondering if it is possible and how to do the following search?

Got a field with URLs ( for example: /v0.1/first/second/third?= ) and a field with IPs that have hit each URL.

ex:
"URL /v0.1/first/second/third=12 IP: 10.10.10.10 "
"URL /v0.1/first/second/third=123 IP: 11.11.11.11 "
"URL /v0.1/first/second/third=1234 IP: 12.12.12.12"
"URL /v0.1/first/second/123 IP: 13.13.13.13 "
"URL /v0.1/first/1234 IP: 13.13.13.13"

How should I make my search in order to:

match and count the number of hits per IP against each URL (the tricky part: by parsing and counting the URLs in total /v0.1/first/ without the rest of the URL) to get total count of hits per all URLs, per minute, per hour and per IP)

It's not definitely all of this to be in one search ( one for total counts, one for per minute etc )

so far I've come with:

source="....." | stats dc(URL) as count by URL,IP | sort -count
and it shows me a field with URLs, IP, and count of URL<->IP hits

yep.. I know.. splunk noob here

Any ideas will be much appreciated 🙂

[woodcock]

I do not understand what you mean but I think that this should give you more than you need:

... | rex field=URL "^(?<URL3segments>(?:[^/]/){3})" | stats count as hits dc(URL) values(URL) dc(IP) values(IP) by URL3segments

[rphillips_splk]

it sounds like you want to extract a portion of the URL into its own field correct?
/v0.1/first

[somesoni2]

Is there any specific rule that can be set here about URL portion to be counted, only the first Two segments to be counted?