Getting Data In

split url and perform a count on it.

rh990
Engager

You'll have to pardon the newbie question. I'm sure this is crazy easy, but I'm having the worst time figuring it out. My logs have a URL field in them and I want to split out the query string and do a count on the URL minus the query sting. I've tried a bunch of different things, but nothing I've tried has really gotten me what I'm after.

An example might be like:
www.nasdaq.com/symbol/?Load=true&Search=ssss
www.nasdaq.com/symbol/?Load=true&Search=ddd
www.nasdaq.com/symbol/?Load=true&Search=xxx
www.nasdaq.com

I'd like to see
www.nasdaq.com/symbol/ 3
www.nasdaq.com 1

Tags (2)
0 Karma
1 Solution

sundareshr
Legend

Try this

... | eval url=mvindex(split(request_uri, "?"), 0) | stats count by url

View solution in original post

aluruguna
Engager

I want answer for exactly same question but I want the count value of everything group urls i.e---

An example might be like:
www.nasdaq.com/symbol/?Load=true&Search=ssss
www.nasdaq.com/symbol/?Load=true&Search=ddd
www.nasdaq.com/symbol/?Load=true&Search=xxx
www.nasdaq.com

I'd like to see
www.nasdaq.com-4

I was using "My search|stats count by url " but I m getting all the results like this
URL Count
www.nasdaq.com/symbol/?Load=true&Search=ssss 1
www.nasdaq.com/symbol/?Load=true&Search=ddd 1
www.nasdaq.com/symbol/?Load=true&Search=xxx 1
www.nasdaq.com 1

I'd like to see
URL Count
www.nasdaq.com 4

0 Karma

sundareshr
Legend

Try this

... | eval url=mvindex(split(request_uri, "?"), 0) | stats count by url

rh990
Engager

I've tried this one and I get no results for statistics when I use it. I see plenty of results for events, but nothing for statistics.

index="sss" Application.AppName = "xxxx*" Header.Type=inbound | eval url=mvindex(split(Service.URL, "?"), 0) | stats count by url
0 Karma

somesoni2
Revered Legend

Your field name contains special characters, so in eval (and where) command, use it within single quotes. Like this

index="sss" Application.AppName = "xxxx*" Header.Type=inbound | eval url=mvindex(split('Service.URL', "?"), 0) | stats count by url

rh990
Engager

The special character in the field name was it. Thank you so much. I figured it was something simple, I'm just new to it.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...