Splunk Search

Can you help me create a separate field called "customer" that contains the following values?

Mohsin123
Path Finder

Hi

I was trying to group by together the field values .

Example: i have a field called "url" that has such sort of data :

/customer/a1
/customer/b1

Can you please help me figure out whether I can create a separate field called "customer" that contains the values :

/customer/a1   and   /customer/a2

purpose is: i am getting >100k results for the timechart for a 24 hours frame .

And hence, data loading doesn't happen

Can you please help ?

Tags (2)
0 Karma

harsmarvania57
Ultra Champion

Hi @Mohsin123,

Can you please try this query?

< your base search> | stats values(eval(if(url="/customer/a1" AND url="/customer/b1",user,null()))) AS customer
0 Karma

Mohsin123
Path Finder

Thank you so much ,
but could you please tell me if i want to add like for the url values , then????
because i have >10000 url values in the url field

0 Karma

Mohsin123
Path Finder

i used like this , but its not working

| stats values(eval(if(like(url,"%oauth%")))) AS OAUTH

0 Karma

harsmarvania57
Ultra Champion

It should be like this

| stats values(eval(if(like(url,"%oauth%"),user,null()))) AS OAUTH

0 Karma

Mohsin123
Path Finder

@harsmarvania57

This still doenst work
| stats values(eval(if(like(url,"%oauth%"),user,null()))) AS OAUTH values(eval(if(like(url,"%well-known%"),user,null()))) AS WELL-KNOWN , values(eval(if(like(url,"%customer%"),user,null()))) AS CUSTOMER , values(eval(if(like(url,"%admin%"),user,null()))) AS ADMIN

0 Karma

harsmarvania57
Ultra Champion

Can you please provide some sample data (Mask sensitive data) ? In your environment url & user fields are extracting automatically ? Also please provide your full splunk query.

I have tested similar query on Windows event logs and it is working fine.

index=wineventlog | stats values(eval(if(like(EventCode, "462%"),host,null()))) as macth_host by EventCode
0 Karma

Mohsin123
Path Finder

@harsmarvania57

Hi Harsh ,
Could you please tell me if i could timechart after a stats group by .
below is my query :

index=idxd sourcetype IN ("prhe_access", "prod") | rex field=_raw "\"GET\ (?[^\"\?]+).*\ HTTP"

| stats values(eval(if(like(url,"%oauth%"),url,null()))) AS OAUTH values(eval(if(like(url,"%well-known%"),url,null()))) AS WELL-KNOWN , values(eval(if(like(url,"%customer%"),url,null()))) AS CUSTOMER , values(eval(if(like(url,"%admin%"),url,null()))) AS ADMIN

0 Karma

harsmarvania57
Ultra Champion

For timechart you should have count or average (Or some digit values) to create chart over time range, in your query you are just fetching URL values and you can't create timechart on those values.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...