Splunk Search

Help searching IIS/W3C log for parent URL?

marshallsuk
Engager

We're indexing a set of standard IIS W3C logs into our indexer and have a need to obtain a list of the parent sites for every URL that's been recorded in the logs, and the latest time each has been called.

I've got a search that will return every URL and the latest time it was recorded in the log but I can't work out how to break the URLs down to their parent and query by that instead. I think I need to use a regex somehow (or maybe some kind of eval?) but I'm not sure. Has anyone done this before? 

This is the base search I'm using:

index=iis s_contentpath = "/sites/Teams*" | dedup s_contentpath | chart last(_time) as Time by s_contentpath | convert ctime(Time) | sort Time asc

I've attached a small sample of the result set. For these examples, I'd be looking to return something like this:

Parent URL Time
/sites/Teams5/Nat_Man_MLP/ 02/07/2023 10:55:00
/sites/Teams5/connect-HRIS/ 02/07/2023 11:04:26
/sites/Teams5/C-D/ 02/07/2023 12:39:19

 

Any help would most appreciated.

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @marshallsuk,

You have to extract a part or your URLs wi the parent_sites.

I tried using you table, but, for the next time, please, don't use a screenshot because it's completetly unuseful to test a regex, but put some sample data using the Insert/Edit Code Sample Button.

Anyway, please test this regex:

index=iis s_contentpath = "/sites/Teams*" 
| rex field=s_contentpath "\/sites\/Teams5\/(?<s_contentpath>[^\/]+)"
| dedup s_contentpath 
| chart last(_time) as Time by s_contentpath 
| convert ctime(Time) 
| sort Time asc

you can test the regex at https://regex101.com/r/gYJ1NM/1

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @marshallsuk,

You have to extract a part or your URLs wi the parent_sites.

I tried using you table, but, for the next time, please, don't use a screenshot because it's completetly unuseful to test a regex, but put some sample data using the Insert/Edit Code Sample Button.

Anyway, please test this regex:

index=iis s_contentpath = "/sites/Teams*" 
| rex field=s_contentpath "\/sites\/Teams5\/(?<s_contentpath>[^\/]+)"
| dedup s_contentpath 
| chart last(_time) as Time by s_contentpath 
| convert ctime(Time) 
| sort Time asc

you can test the regex at https://regex101.com/r/gYJ1NM/1

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...