Splunk Search

How to extract a particular field from a URI in Splunk?

jagdeepgupta813
Explorer

My data is coming like below in splunk

method=PUT uri=/AppA/USA/comp1/Refrence/20160120A123456/price query= httpstatus=200 bytes=7772 processtime=682 ms

or

method=PUT uri=/AppA/USA/comp2/tax query= httpstatus=200 bytes=7772 processtime=682 ms

I want to get the last value after / from the URI column and the average process time for that in a time frame.

For example, for a day, I want to see the average time taken for service tax and price.

And how do I get any value in between URI? For example, I want to get the country type from the above URI, and want to see the average time taken for each service in different countries.

0 Karma
1 Solution

masonmorales
Influencer

Try:

| rex field=uri "\/\w+\/(?<Country>\w+)" | rex field=uri "\/(?<Type>\w+)\s"

Should extract a field called "Country" and a field called "Type". I assume bytes, httpstatus, and processingtime are auto-extracted for you by Splunk since they're key=value pairs.

View solution in original post

s2_splunk
Splunk Employee
Splunk Employee

You can do it all in one go by using this (no need to escape forward slashes:

rex field=uri "/\w+/(?<Country>\w+).*/(?<Service>\w+)$"
0 Karma

jagdeepgupta813
Explorer

why this is not working
rex field=url "\/(?\d+)$"

I tried this as well
rex field=url "\/(?\d+)RETURN"

However , this worked
rex field=url "\/(?\d{10,})$"

my url field has value like
http://IP:PORT/Folder1/rest/service1/1234/Stor3/001/12345678910/RETURN

0 Karma

jagdeepgupta813
Explorer

It was my bad, this worked

rex field=url "\/(?\d+)\/RETURN"

0 Karma

masonmorales
Influencer

Try:

| rex field=uri "\/\w+\/(?<Country>\w+)" | rex field=uri "\/(?<Type>\w+)\s"

Should extract a field called "Country" and a field called "Type". I assume bytes, httpstatus, and processingtime are auto-extracted for you by Splunk since they're key=value pairs.

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...