Splunk Search

How to display the last uri_path in each transaction event?

ashnet16
Path Finder

Currently I'm using: sourcetype=access_*|transaction clientip maxpause=1h keepevicted=t mvlist=t | table uri_path . This search displays all uri_paths occurring in a given transaction. I would like to display the last uri_path of each event. The results of my current search is below.

/category.screen
/product.screen
/oldlink
/cart.do
/cart.do
/category.screen
/cart.do
/cart/success.do
/category.screen
/oldlink

/cart.do

/product.screen
/cart.do
/product.screen
/category.screen
/cart.do
/product.screen
/cart.do
/product.screen
/cart.do
/cart/success.do
/cart.do

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can grab the last value of a multivalue field like this:

... | eval last_uri_path = mvindex(uri_path, -1)

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can grab the last value of a multivalue field like this:

... | eval last_uri_path = mvindex(uri_path, -1)

View solution in original post

ashnet16
Path Finder

THANK YOU! This works out perfectly!

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.