Splunk Search

Count of Value Pairs in URI Query String

chca
Path Finder

Assuming my URL_Query field contains the following data:


cdata=153&orgid=0012
orgid=3924&cdata=129
cdata=153&orgid=3924

How can I display a table containing a unique count of value pairs cdata?


cdata count
153 2
129 1

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee
... | extract auto=true | stats count by cdata

Actually, unless you've done something to turn it off, the fields will usually have been auto extracted by Splunk without you having to call the extract command.

0 Karma

chca
Path Finder

I also found this answer:
http://splunk-base.splunk.com/answers/8404/chart-over-query-string

However, I don't have the value pairs pre-parsed. I need to do it during the search.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...