Grouping HTTP GET requests based on first directory

[JaredYong]

Very new to splunk here. I would like to group each http request to each directory based on their directory, and produce a count for each and plot it in a pie chart.

GET /vendor, GET /Services, GET /config, GET /About

For example GET /vendor/vendor/auth/signin  and GET /vendor/vendor/browse should be classified under /vendor in a table.

my current query is wrong and doesn't show anything, modified it based on a GIAC paper.

index="apache_logs" | stats count by request | eval request=case(
request="GET /config*", "/config",
request="GET /vendor*", "/vendor",
request="GET /Services*", "/Services",
request="GET /About*", "/About")
request="GET /about*", "/about")
| top request limit=0 useother=f
| eval request=request." (".count." events, ".round(percent,2)."%)"

I would also like to differentiate requests to /about and /About 
 I hope this made sense. 

[ITWhisperer]

index="apache_logs" 
| stats count by request 
| eval request=split(request,"/")
| eval request="/".mvindex(request,1)
| top request limit=0 useother=f
| eval request=request." (".count." events, ".round(percent,2)."%)"

[JaredYong]

Hi I have tried your solution, but it seems like its all categorized under /backend in the result, showing 30 events, while i should have 133 events. upon closer inspection, I noticed that each of the 30 events have their own count, which adds up to 133. How should I modify the solution such that it shows 133 instead of 30?

[ITWhisperer]

Change the order of the commands so that the directory is resolved before the counting

index="apache_logs" 
| eval request=split(request,"/")
| eval request="/".mvindex(request,1)
| stats count by request 
| top request limit=0 useother=f
| eval request=request." (".count." events, ".round(percent,2)."%)"

[venkatasri · Accepted solution]

Hi @JaredYong 

Can't give you a final query, however you can try using the combination of field extraction of /directory/ and stats it.

Example:

<your_base_query> "GET"
| rex field=request "\/(?<dir>\w+)\/" 
| stats count by dir

--

An upvote would be appreciated if this reply helps!

[JaredYong]

one slight problem though, i am unable to put in the percentage for the pie chart, am i missing something here?

[venkatasri]

@JaredYong  Are you good with pie chart?

[JaredYong]

Thank you for this solution!