Splunk Search

Help searching IIS/W3C log for parent URL?

marshallsuk
Engager

We're indexing a set of standard IIS W3C logs into our indexer and have a need to obtain a list of the parent sites for every URL that's been recorded in the logs, and the latest time each has been called.

I've got a search that will return every URL and the latest time it was recorded in the log but I can't work out how to break the URLs down to their parent and query by that instead. I think I need to use a regex somehow (or maybe some kind of eval?) but I'm not sure. Has anyone done this before? 

This is the base search I'm using:

index=iis s_contentpath = "/sites/Teams*" | dedup s_contentpath | chart last(_time) as Time by s_contentpath | convert ctime(Time) | sort Time asc

I've attached a small sample of the result set. For these examples, I'd be looking to return something like this:

Parent URL Time
/sites/Teams5/Nat_Man_MLP/ 02/07/2023 10:55:00
/sites/Teams5/connect-HRIS/ 02/07/2023 11:04:26
/sites/Teams5/C-D/ 02/07/2023 12:39:19

 

Any help would most appreciated.

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @marshallsuk,

You have to extract a part or your URLs wi the parent_sites.

I tried using you table, but, for the next time, please, don't use a screenshot because it's completetly unuseful to test a regex, but put some sample data using the Insert/Edit Code Sample Button.

Anyway, please test this regex:

index=iis s_contentpath = "/sites/Teams*" 
| rex field=s_contentpath "\/sites\/Teams5\/(?<s_contentpath>[^\/]+)"
| dedup s_contentpath 
| chart last(_time) as Time by s_contentpath 
| convert ctime(Time) 
| sort Time asc

you can test the regex at https://regex101.com/r/gYJ1NM/1

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @marshallsuk,

You have to extract a part or your URLs wi the parent_sites.

I tried using you table, but, for the next time, please, don't use a screenshot because it's completetly unuseful to test a regex, but put some sample data using the Insert/Edit Code Sample Button.

Anyway, please test this regex:

index=iis s_contentpath = "/sites/Teams*" 
| rex field=s_contentpath "\/sites\/Teams5\/(?<s_contentpath>[^\/]+)"
| dedup s_contentpath 
| chart last(_time) as Time by s_contentpath 
| convert ctime(Time) 
| sort Time asc

you can test the regex at https://regex101.com/r/gYJ1NM/1

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...