Splunk Search

How to combine two values from the same field?

msarkaus
Path Finder

I'm trying to combine two simular values from the same field. and rename the values.

Splunk pic2.png

I would like to combine  /v1/product and /v1/product/ and rename it Product API

Search String:

| stats count by urlPthTxt

I did try a few different  commands but didn't work. Please help.

Thanks

Labels (1)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @msarkaus,

if the structure of your field is always: /string/string and changes only for the last slash, you could use a regex like this:

<your_search>
| rex field=urlPthTxt "^(?<urlPthTxt_new>\/\w+\/\w+)"

that you can test at https://regex101.com/r/JqzYh2/1

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...