Different values of parameters

[xvxt006]

Hi,

I have below variations of uri patterns for a particular functionality. i want to list out query string parameters and their values separately (in a tabular format or any other format).

Say for example

For q
value count
XXX 5
YYY 3

i tried to use rex and extract fileds (q, Index, items, country, lan) but as the uri formats are in different right boundaries (for example q has right boundary & in 1st and 2nd uri pattern but i the 3rd it has no &). So how do we deal with these kind of situations?

Uri formats:

/perform?q=XXX&Index=XXX&items=XXX
/perform?q=XXX&Index=XXX&items=XXX&account=&country=XXX&lan=XXX
/perform?q=YYY
/perform?q=YYY&account=XXX
/perform?q=YYY&Index=XXX&items=XXX&account=XXX&country=XXX&lan=XXX
/perform?q=XXX&account=XXX&items=XXX
/perform?q=XXX&account=XXX&country=XXX
/perform?q=XXX&Index=XXX&items=XXX
/perform?q=XXX&account=XXX&Index=XXX&items=XXX

[somesoni2]

Try this

<<your base search giving field uri >>| rex field=uri "q=(?<q>.*)" | eval q="a=".q | rex field=q max_match=0 "(\w+=)+(?<value>[^&]+)" | mvexpand value | stats count by value

Update:

 <<your base search giving field uri >> | rex field=uri "q=(?<q>.*)" | eval q="q=".q | rex field=q max_match=0 "(?<key>\w+)=(?<value>[^&]+)" | eval temp=mvzip(key,value) | mvexpand temp | rex field=temp "(?<key>.*),(?<value>.*)" | stats count by key,value | stats list(count) list(value) by key

[somesoni2]

Try the updated answer.

[xvxt006]

i have tried the query and it is giving me all the value but it is not separating by each key. Meaning for q these are all the values, account these are all the values, index these are all the values, etc

[xvxt006]

Hi, if i understand it correctly, you are getting the query string into q and i did not get why you have eval q="a=".q and then you are taking that result and you are trying to separate the values using & and you have max_match=0 as it has multi value field?