Splunk Search

How can I extract part of a URI and group them and create a table.

Explorer

I have a statistic to get where I am getting multiple lines but unable to group them into one and display the result like.

Getting -
URI | error . | count . |
/offer/transaction/ . | 200 | 5 . |
/offer/transaction/298759829 . 300 1
/offer/transaction/5683435 300 1
/offer/transaction/0578285 . 200 1
/offer/clear-up-in/9646789 . 200 1
/offer/transaction/87589889. 200 1

Need -
URI error count
/offer/transaction/ . 200 6
/offer/transaction/ 300 2
/offer/transaction/ 500 1
/offer/clear-up-in/ . 200 . 2

0 Karma

Motivator

your search | rex field=URI "(?P&ltnewuri>/\S+/\S+/)\S+" | stats sum(count) by newuri error

0 Karma