Splunk Search

How to combine two values from the same field?

msarkaus
Path Finder

I'm trying to combine two simular values from the same field. and rename the values.

Splunk pic2.png

I would like to combine  /v1/product and /v1/product/ and rename it Product API

Search String:

| stats count by urlPthTxt

I did try a few different  commands but didn't work. Please help.

Thanks

Labels (1)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @msarkaus,

if the structure of your field is always: /string/string and changes only for the last slash, you could use a regex like this:

<your_search>
| rex field=urlPthTxt "^(?<urlPthTxt_new>\/\w+\/\w+)"

that you can test at https://regex101.com/r/JqzYh2/1

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...