Splunk Search

How do I group similar URLs into one event?

deeps1984
New Member

I am doing a search to get the total count of different URIs and their response times. My result has multiple events of similar URLs -

Like /abc/{id1}/xyz;  
/abc/{id2}/xyz
/abc/{id3}/xyz.

Only the {id} in the URL varies, and the rest of the URI portion is same.

How can I group these events as 1 event, and still get the total count of hits to this URI?

This is my search -

index=stuff RelativeURI="/abc/*/xyz"  |stats count as total_call_count, avg(ResponseTime) as avgResponse by RelativeURI
0 Karma

sundareshr
Legend

Try this

index=stuff RelativeURI="/abc/*/xyz" | rex field=RelativeURI "(?<url1>\/\S+\/)\S+\/(?<url2>\S+)" | eval url=url1.url2 | stats count as total_call_count, avg(ResponseTime) as avgResponse by url
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

index=stuff RelativeURI="/abc/*/xyz" | eval RelativeURI =replace(RelativeURI ,"^(\/[^\/]+\/)([^\/]+)(\/[^\/]+)","\1XXX\3") |stats count as total_call_count, avg(ResponseTime) as avgResponse by RelativeURI
0 Karma

somesoni2
SplunkTrust
SplunkTrust

On second thought, if you're hardcoding the URL (format at least) in the base search, why not just remove the by clause from stats. That will give you total count and average for all matching URI's. Like this

index=stuff RelativeURI="/abc/*/xyz" |stats count as total_call_count, avg(ResponseTime) as avgResponse | eval RelativeURI="/abc/*/xyz" | table RelativeURI total_call_count avgResponse 
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...