Splunk Search
Highlighted

Can I perform stats count on a substring using regex?

Engager

I have log events such as activity:http://xyz/rest/876
http://xyz/rest/223
http://xyz/rest/263
http://xyz/rest/4534
http://abc/rest/1
when I do stats count by activity I want to get results as:
http://xyz/rest 4
http://abc/rest 1

How can it be best done?

0 Karma
Highlighted

Re: Can I perform stats count on a substring using regex?

SplunkTrust
SplunkTrust

Try this:

|  rex "(?<activity>http:\/\/[^\/]*\/rest)" 
| stats count as mycount by activity

View solution in original post