split url and perform a count on it.

[rh990]

You'll have to pardon the newbie question. I'm sure this is crazy easy, but I'm having the worst time figuring it out. My logs have a URL field in them and I want to split out the query string and do a count on the URL minus the query sting. I've tried a bunch of different things, but nothing I've tried has really gotten me what I'm after.

An example might be like:
www.nasdaq.com/symbol/?Load=true&Search=ssss
www.nasdaq.com/symbol/?Load=true&Search=ddd
www.nasdaq.com/symbol/?Load=true&Search=xxx
www.nasdaq.com

I'd like to see
www.nasdaq.com/symbol/ 3
www.nasdaq.com 1

[aluruguna]

I want answer for exactly same question but I want the count value of everything group urls i.e---

An example might be like:
www.nasdaq.com/symbol/?Load=true&Search=ssss
www.nasdaq.com/symbol/?Load=true&Search=ddd
www.nasdaq.com/symbol/?Load=true&Search=xxx
www.nasdaq.com

I'd like to see
www.nasdaq.com-4

I was using "My search|stats count by url " but I m getting all the results like this
URL Count
www.nasdaq.com/symbol/?Load=true&Search=ssss 1
www.nasdaq.com/symbol/?Load=true&Search=ddd 1
www.nasdaq.com/symbol/?Load=true&Search=xxx 1
www.nasdaq.com 1

I'd like to see
URL Count
www.nasdaq.com 4

[sundareshr · Accepted solution]

Try this

... | eval url=mvindex(split(request_uri, "?"), 0) | stats count by url

[rh990]

I've tried this one and I get no results for statistics when I use it. I see plenty of results for events, but nothing for statistics.

index="sss" Application.AppName = "xxxx*" Header.Type=inbound | eval url=mvindex(split(Service.URL, "?"), 0) | stats count by url

[somesoni2]

Your field name contains special characters, so in eval (and where) command, use it within single quotes. Like this

index="sss" Application.AppName = "xxxx*" Header.Type=inbound | eval url=mvindex(split('Service.URL', "?"), 0) | stats count by url

[rh990]

The special character in the field name was it. Thank you so much. I figured it was something simple, I'm just new to it.