How can I multiple search and table data?

[super_edition]

Hello,

I have a below splunk query which gives me response time value extracted from its response.

index=my_index openshift_cluster="cluster009" sourcetype=openshift_logs openshift_namespace=my_ns openshift_container_name=contaner |  search "POST /payment/orders/v1 HTTP"  

sample response message:

"message": {
"input": "192.168.56.10 - - [03/Apr/2023:08:26:18 +0000] \"GET /payment/orders/v1/1b8ee28e-a42b-4ef0-9063-6f36302aeac2-ntt HTTP/1.1\" 200 9907 8080 13 ms"
}

To the above query, If I add the pre-extracted variables - processDuration, serviceURL - I get the average/response90 values which I want

| stats avg(processDuration) as average perc90(processDuration) as response90 by serviceURL | eval average=round(average,2),response90=round(response90,2)

Now, I have 4 different search text:

CreateOrder: search "POST /payment/orders/v1 HTTP"
getOrder: search "GET /payment/orders/*-* HTTP"
processOrder: search "POST /payment/orders/*/process HTTP"
validate: search "POST /payment/orders/*/validate HTTP"

I want to build a query using these 4 types of search and get the response time details as below:

Operations	average	response90
CreateOrder	250	380
getOrder	240	330
processOrder	210	321
validate	260	365

[super_edition]

Thanks @ITWhisperer  the query worked as expected. However I have 1 more pattern of search text to include. From the below:

"message":{"input":"192.168.62.10 - - [06/Apr/2023:05:45:51 +0000] \"GET /shopping/carts/v1/e5aa581b-ac7a-40f5-a8da-8ab5cb51039c/summary HTTP/1.1\" 200 636 8080 13 ms"}

"message":{"input":"192.168.54.47 - - [06/Apr/2023:04:08:13 +0000] \"GET /shopping/carts/v1/734b2f55-c304-49a5-baa9-8e9994495b55 HTTP/1.1\" 200 1855 8080 10 ms"}

"message":{"input":"192.168.54.47 - - [06/Apr/2023:04:08:13 +0000] \"GET /shopping/carts/v1/734b2f55-c304-49a5-baa9-8e9994495b55/product HTTP/1.1\" 200 1855 8080 10 ms"}

"message":{"input":"192.168.54.47 - - [06/Apr/2023:04:08:13 +0000] \"GET /location-context/stations/v1/CJS?module=ONLINE_BOOKING&requestedPoint=DESTINATION HTTP/1.1\" 200 1855 8080 10 ms"}

From the above, I am interested to extract only the orange highlighted string eg: 

GET /shopping/carts/v1/<ending with any id alone> HTTP

I tried with below splunk query as intermediate step to extract the urls:

index=my_index openshift_cluster="cluster009" sourcetype=openshift_logs openshift_namespace=my_ns openshift_container_name=contaner | rex field=message.input "(?<servicename>(?:[^\"]|\"\")*HTTP)" | dedup servicename | stats count by servicename

But this returns the all pattern.

GET /shopping/carts/v1/e5aa581b-ac7a-40f5-a8da-8ab5cb51039c/summary HTTP
GET /shopping/carts/v1/734b2f55-c304-49a5-baa9-8e9994495b55 HTTP (I need only this)
GET /shopping/carts/v1/734b2f55-c304-49a5-baa9-8e9994495b55/product HTTP
GET /location-context/stations/v1/CJS?module=ONLINE_BOOKING&requestedPoint=DESTINATION HTTP

[ITWhisperer · Accepted solution]

Try something like this

index=my_index openshift_cluster="cluster009" sourcetype=openshift_logs openshift_namespace=my_ns openshift_container_name=contaner ("POST /payment/orders/v1 HTTP"  OR "GET /payment/orders/*-* HTTP" OR "POST /payment/orders/*/process HTTP" OR "POST /payment/orders/*/validate HTTP")
| eval Operations=case(searchmatch("POST /payment/orders/v1 HTTP"),"CreateOrder", searchmatch("GET /payment/orders/*-* HTTP"),"getOrder", searchmatch("POST /payment/orders/*/process HTTP"),"processOrder", searchmatch("POST /payment/orders/*/validate HTTP"),"validate")
| stats avg(processDuration) as average perc90(processDuration) as response90 by Operations | eval average=round(average,2),response90=round(response90,2)