Splunk Search

Can I perform stats count on a substring using regex?

chetan1974
Engager

I have log events such as activity:http://xyz/rest/876
http://xyz/rest/223
http://xyz/rest/263
http://xyz/rest/4534
http://abc/rest/1
when I do stats count by activity I want to get results as:
http://xyz/rest 4
http://abc/rest 1

How can it be best done?

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

Try this:

|  rex "(?<activity>http:\/\/[^\/]*\/rest)" 
| stats count as mycount by activity

View solution in original post

DalJeanis
SplunkTrust
SplunkTrust

Try this:

|  rex "(?<activity>http:\/\/[^\/]*\/rest)" 
| stats count as mycount by activity

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!