Splunk Search

Can I perform stats count on a substring using regex?

chetan1974
Engager

I have log events such as activity:http://xyz/rest/876
http://xyz/rest/223
http://xyz/rest/263
http://xyz/rest/4534
http://abc/rest/1
when I do stats count by activity I want to get results as:
http://xyz/rest 4
http://abc/rest 1

How can it be best done?

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

Try this:

|  rex "(?<activity>http:\/\/[^\/]*\/rest)" 
| stats count as mycount by activity

View solution in original post

DalJeanis
SplunkTrust
SplunkTrust

Try this:

|  rex "(?<activity>http:\/\/[^\/]*\/rest)" 
| stats count as mycount by activity

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.