Splunk Search

How to develop a line chart that counts each subdirectory in the URL?

jandresaedo
Engager

Hello Guys,
I have 3 different directory in the same URL, for example:

  1. https://anydns.com:443/event/anyother.xml
  2. https://anydns.com:443/cupcake/any.json
  3. https://anydns.com:443/something/any.xml

So I want count every sub-directory in the URL, and I tried with the following search:

index=some_index url="https://anydns.com:443/*/" | timechart count(url) by url

But my line chart or the statistics in the Eje x splits into every URL and I want to see 1 graph with statistics about how much picks had one URL in some time.

Thank you and sorry for my bad english.

0 Karma
1 Solution

gokadroid
Motivator

There might be many ways but how about trying something like this :

your query to return events
| rex field=_raw "(?<fullUrl>(?<preFix>https:\/\/anydns\.com:443)\/(?<subDir>[^\/]+)\/(?<suffix>.*))"
| timechart count by subDir

Please take a note of all four fields fullUrl, preFix, subDir and suffix. You can use any combination of these in the above timechart something like | timechart count by preFix or say
| timechart count by suffix and so on...

View solution in original post

gokadroid
Motivator

There might be many ways but how about trying something like this :

your query to return events
| rex field=_raw "(?<fullUrl>(?<preFix>https:\/\/anydns\.com:443)\/(?<subDir>[^\/]+)\/(?<suffix>.*))"
| timechart count by subDir

Please take a note of all four fields fullUrl, preFix, subDir and suffix. You can use any combination of these in the above timechart something like | timechart count by preFix or say
| timechart count by suffix and so on...

View solution in original post

jandresaedo
Engager

Thank you for your's answers guys, I'm good now.

See ya.
JA

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Sounds like you want to ignore the actual filename, and stop your URL at the last slash.

Everything before the break just generates test data. the "meat" is the rex.

| gentimes start=10/1/16 end=10/5/16          | eval URL = "https://anydns.com:443/event/anyother.xml"
| append [| gentimes start=10/3/16 end=10/7/16 | eval URL = "https://anydns.com:443/cupcake/any.json"]
| append [| gentimes start=10/1/16 end=10/5/16 | eval URL = "https://anydns.com:443/cupcake/any.json"]
| append [| gentimes start=10/2/16 end=10/4/16 | eval URL = "https://anydns.com:443/cupcake/any.json"]
| append [| gentimes start=10/2/16 end=10/7/16 | eval URL = "https://anydns.com:443/cupcake/someother.json"]
| append [| gentimes start=10/2/16 end=10/4/16 | eval URL = "https://anydns.com:443/something/any.xml"]
| eval _time = starttime

| rex field=URL "(?<suburl>\w+:.*/)"
| timechart count by suburl
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!