How to combine two values from the same field?

[msarkaus]

I'm trying to combine two simular values from the same field. and rename the values.

Splunk pic2.png

I would like to combine  /v1/product and /v1/product/ and rename it Product API

Search String:

| stats count by urlPthTxt

I did try a few different  commands but didn't work. Please help.

Thanks

[gcusello]

Hi @msarkaus,

if the structure of your field is always: /string/string and changes only for the last slash, you could use a regex like this:

<your_search>
| rex field=urlPthTxt "^(?<urlPthTxt_new>\/\w+\/\w+)"

that you can test at https://regex101.com/r/JqzYh2/1

Ciao.

Giuseppe