Splunk Search

How to count stats by grouping substring from an URI

prakashpnvs
Engager

Here is my search:
index=app sourcetype=access context=PL uri=/PL/data/2.0/space/*

and I have the following logs in my search:
/PL/data/2.0/space/appA/29323820jdd3723.txt
/PL/data/2.0/space/appA/search/373367672djbd
/PL/data/2.0/space/appB/abcdefsfjdf.pdf
/PL/data/2.0/space/appB/get/9668568696
/PL/data/2.0/space/appC/search/9650865686rt
/PL/data/2.0/space/appD/6384387498374.jpg

Now, I want the stats count results like below:
appA 2
appB 2
appC 1
appD 1

0 Karma
1 Solution

Anantha123
Communicator

Try this
index=app sourcetype=access context=PL uri=/PL/data/2.0/space/*
| rex field=uri "/PL/data/2.0/space/(?< APP>[^/]+)/(?< Request>[^\s]+)"
| table App Request
| stats count by APP

View solution in original post

Anantha123
Communicator

Try this
index=app sourcetype=access context=PL uri=/PL/data/2.0/space/*
| rex field=uri "/PL/data/2.0/space/(?< APP>[^/]+)/(?< Request>[^\s]+)"
| table App Request
| stats count by APP

prakashpnvs
Engager

Executed this in Splunk UI and got the results in Visualization tab
index=app sourcetype=access context=PL uri=/PL/data/2.0/space/* | rex field=uri "/PL/data/2.0/space/(?< APP>[^/]+)/(?< Request>[^\s]+)" | stats count by APP

also sorted it by ..... | sort - count

Thanks much!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...