Help searching IIS/W3C log for parent URL?

[marshallsuk]

We're indexing a set of standard IIS W3C logs into our indexer and have a need to obtain a list of the parent sites for every URL that's been recorded in the logs, and the latest time each has been called.

I've got a search that will return every URL and the latest time it was recorded in the log but I can't work out how to break the URLs down to their parent and query by that instead. I think I need to use a regex somehow (or maybe some kind of eval?) but I'm not sure. Has anyone done this before? 

This is the base search I'm using:

index=iis s_contentpath = "/sites/Teams*" | dedup s_contentpath | chart last(_time) as Time by s_contentpath | convert ctime(Time) | sort Time asc

I've attached a small sample of the result set. For these examples, I'd be looking to return something like this:

Parent URL	Time
/sites/Teams5/Nat_Man_MLP/	02/07/2023 10:55:00
/sites/Teams5/connect-HRIS/	02/07/2023 11:04:26
/sites/Teams5/C-D/	02/07/2023 12:39:19

Any help would most appreciated.

[gcusello · Accepted solution]

Hi @marshallsuk,

You have to extract a part or your URLs wi the parent_sites.

I tried using you table, but, for the next time, please, don't use a screenshot because it's completetly unuseful to test a regex, but put some sample data using the Insert/Edit Code Sample Button.

Anyway, please test this regex:

index=iis s_contentpath = "/sites/Teams*" 
| rex field=s_contentpath "\/sites\/Teams5\/(?<s_contentpath>[^\/]+)"
| dedup s_contentpath 
| chart last(_time) as Time by s_contentpath 
| convert ctime(Time) 
| sort Time asc

you can test the regex at https://regex101.com/r/gYJ1NM/1

Ciao.

Giuseppe