How do you group by substring of URI?

[vas123]

I have raw data like below:

/?AID=10654946&PID= 40
/test_main.jsp       232
/topic1.jsp?redirectPage=/main/word/undefined 50
/topic1.jsp?redirectPage=/site.webmaster 200

I would like have the url up until "?" and some URI does not have "?"

I would like to see as below

URI Count
/ 40
/topic_request.jsp 250
/test_main.jsp 232

Can some one give me an idea how I can achieve this?

[woodcock]

I would use the URL toolbox app for this:

https://splunkbase.splunk.com/app/2734/

[spavin · Accepted solution]

Hi @vas123,

You can do this via the rex command:

| makeresults count=4 
| streamstats count as id 
| eval url=case(id=1,"/", id=2,"/?AID=10654946&PID= 40", id=3,"/topic1.jsp?redirectPage=/main/word/undefined 50",id=4,"/topic1.jsp?redirectPage=/site.webmaster 200")
| rex field=url "^(?<page>[^?]+)(?<querystring>\?[^\s]+)?\s(?<count>[0-9]+)$"
| stats sum(count) as "Total Count" by page

The first few lines are just to setup the test data - you'd only need the last two lines.

If you are interested in the querystring, it's captured too.

[vas123]

Thank you. It worked