Monitoring Splunk

Remove duplicate URLs from search result

r_s01
Explorer

Trying to get success and failure status count using below query but its not filtering out the duplicate URLs, Can someone help me into this? I want result in less number of rows but lob, URI, API_Status  and its count should show.

"*/prescriptions/eni/api/api-cw/*" (URI != "*/prescriptions/eni/api/api-cw/legacySession/cache*") | stats count by lob,URI,API_Staus

Result is coming as below,

r_s01_0-1734769332899.png

 

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Can you give some sample data which helps us to understand this better and found suitable solution? Please anonymous that data if/when needed!
0 Karma

r_s01
Explorer

I am trying to get response on the basis on coming status codes from message.outgoingResponse.istURL, But problem is that there is no field to read return status code from below shared screen shot URL,  is there any way we can get status code as we got from any URL on browser?

Query :-

index="uhcportals-prod-logs" sourcetype=kubernetes container_name="myuhc-sso" logger="com.uhg.myuhc.log.SplunkLog" message.ssoType="Outbound" | spath "message.incomingRequest.partner" | rename message.incomingRequest.partner as "SSO Partner" | search "SSO Partner"=sso_SSOPartner_Amwell | stats count by message.outgoingResponse.istURL


r_s01_0-1734955238416.png

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. You're using a very old Splunk version judging by the screenshot.

2. Your initial search is very, very ineffective (Splunk cannot use its index of terms, it has to look through every single event to find your sought for ones)

3. What do you mean by "filter duplicate URL"? You're counting by a triplet - url, status and lob, whatever that is. So you'll get a separate result for each combination of those three values. If you don't want to break it down by status, don't include that field in the BY clause.

r_s01
Explorer

Thanks for response, There is a field called URI some URI is coming as duplicate. how i can adjust query so that duplicate URI won't come? 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

If you want results by URI then don’t put anything else after by. But then the results is not same as you have with your current query.

....
| stats values(status) as status .... by URI

just replace …. before by with those other fields what you want to see.

But probably this is not what you are looking for?

Can you told what you need to know, not how you try to do it?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...