Splunk AppDynamics

How to group similar referrers together?

Amr_Gamal
Explorer

Hello, 

In my EUM Dashboard, I want to add a pie chart of referrers so it appears as in the attached image 

for example, there is more than one value of google referrers.

I want to group referrers so that all referrers that contains google.com are considered one group (google referrer) and all contains (Facebook.com) has value of Facebook and so on .

I don't need to show distribution based on each unique value

How can I do this?

note: the used query as below

SELECT referrer, count(referrer) FROM web_session_records WHERE referrer IS NOT NULL

Thanks image.png

^ Edited by @Ryan.Paredez for readability.  

Labels (1)
Tags (1)
0 Karma

Morelz
Builder

Hi Amr

You can use the substring & Index ADQLfunctions.

Something like 

SELECT substring(referrer, 9, indexOf(referrer, '/', 3)-9), count(*) FROM web_session_records WHERE referrer IS NOT NULL

Might need to adjust a little bit 

Ciao

Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...