Getting Data In

split url and perform a count on it.

Engager

You'll have to pardon the newbie question. I'm sure this is crazy easy, but I'm having the worst time figuring it out. My logs have a URL field in them and I want to split out the query string and do a count on the URL minus the query sting. I've tried a bunch of different things, but nothing I've tried has really gotten me what I'm after.

An example might be like:
www.nasdaq.com/symbol/?Load=true&Search=ssss
www.nasdaq.com/symbol/?Load=true&Search=ddd
www.nasdaq.com/symbol/?Load=true&Search=xxx
www.nasdaq.com

I'd like to see
www.nasdaq.com/symbol/ 3
www.nasdaq.com 1

Tags (2)
0 Karma
1 Solution

Legend

Try this

... | eval url=mvindex(split(request_uri, "?"), 0) | stats count by url

View solution in original post

Engager

I want answer for exactly same question but I want the count value of everything group urls i.e---

An example might be like:
www.nasdaq.com/symbol/?Load=true&Search=ssss
www.nasdaq.com/symbol/?Load=true&Search=ddd
www.nasdaq.com/symbol/?Load=true&Search=xxx
www.nasdaq.com

I'd like to see
www.nasdaq.com-4

I was using "My search|stats count by url " but I m getting all the results like this
URL Count
www.nasdaq.com/symbol/?Load=true&Search=ssss 1
www.nasdaq.com/symbol/?Load=true&Search=ddd 1
www.nasdaq.com/symbol/?Load=true&Search=xxx 1
www.nasdaq.com 1

I'd like to see
URL Count
www.nasdaq.com 4

0 Karma

Legend

Try this

... | eval url=mvindex(split(request_uri, "?"), 0) | stats count by url

View solution in original post

Engager

I've tried this one and I get no results for statistics when I use it. I see plenty of results for events, but nothing for statistics.

index="sss" Application.AppName = "xxxx*" Header.Type=inbound | eval url=mvindex(split(Service.URL, "?"), 0) | stats count by url
0 Karma

Revered Legend

Your field name contains special characters, so in eval (and where) command, use it within single quotes. Like this

index="sss" Application.AppName = "xxxx*" Header.Type=inbound | eval url=mvindex(split('Service.URL', "?"), 0) | stats count by url

Engager

The special character in the field name was it. Thank you so much. I figured it was something simple, I'm just new to it.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!