Splunk Search

How do I group similar URLs into one event?

deeps1984
New Member

I am doing a search to get the total count of different URIs and their response times. My result has multiple events of similar URLs -

Like /abc/{id1}/xyz;  
/abc/{id2}/xyz
/abc/{id3}/xyz.

Only the {id} in the URL varies, and the rest of the URI portion is same.

How can I group these events as 1 event, and still get the total count of hits to this URI?

This is my search -

index=stuff RelativeURI="/abc/*/xyz"  |stats count as total_call_count, avg(ResponseTime) as avgResponse by RelativeURI
0 Karma

sundareshr
Legend

Try this

index=stuff RelativeURI="/abc/*/xyz" | rex field=RelativeURI "(?<url1>\/\S+\/)\S+\/(?<url2>\S+)" | eval url=url1.url2 | stats count as total_call_count, avg(ResponseTime) as avgResponse by url
0 Karma

somesoni2
Revered Legend

Try this

index=stuff RelativeURI="/abc/*/xyz" | eval RelativeURI =replace(RelativeURI ,"^(\/[^\/]+\/)([^\/]+)(\/[^\/]+)","\1XXX\3") |stats count as total_call_count, avg(ResponseTime) as avgResponse by RelativeURI
0 Karma

somesoni2
Revered Legend

On second thought, if you're hardcoding the URL (format at least) in the base search, why not just remove the by clause from stats. That will give you total count and average for all matching URI's. Like this

index=stuff RelativeURI="/abc/*/xyz" |stats count as total_call_count, avg(ResponseTime) as avgResponse | eval RelativeURI="/abc/*/xyz" | table RelativeURI total_call_count avgResponse 
0 Karma
Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Access to Splunk Observability Kubernetes “Classic Navigator” UI will no longer be available starting January ...

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...