Extract the meaningful fields from the logs

[amitru]

I want to get an API usage report per user and I am struggling with the Splunk Query for this, can someone please help with the query, I tried using rex but didn't get through.

In my app logs, I have a text like -

U87XXXX:ddddffggggggsss.REG.Currency [RestInterceptor]: RestRequest: URI : https://abc.net/api/curr

........  RequestBody: {"loginId": "U87XXXX"}

I want the output as

UserID                     URL                                                 COUNT 

U87XXXX        https://abc.net/api/curr                    5

U78XXXX       https://abc.net/api/xyz                     11 

Thanks in advance.

[Gr0und_Z3r0]

Hi @amitru 

Try something like this and then do a stats command to get insights.

|rex field=_raw "URI\s\:\s(?P<URL>[\w\:\/\.]+)"
|rex field=_raw "loginId\"\:\s\"(?P<UserID>[\w]+)\""
|stats count by UserID URL