How to extract an endpoint until certain value and not the complete route?

[dnavia29]

Hello, I am trying to simplify a search in Splunk taking only my principal endpoints and not the detail transactions, I am using regex to filter this but it still show me all the details, what I want to see is the availability of the endpoint and not separated for transaction.
here is my query.


sourcetype="api-core"
| rename request.body{}.value.request.http_status_code as http_req_result
| convert num(http_req_result) as http_res
| where http_res > 0
| rename http_res as "RequestStatus", request.body{}.value.request.endpoint as Endpoint
| regex Endpoint="^\W\D+\w.\D+"
| stats count(eval(RequestStatus>0)) as total, count(eval(RequestStatus>200)) as errors by Endpoint
| eval disponibilidad=(100-(errors/total*100))
| eval disponibilidad = round(disponibilidad,0)
| table Endpoint, disponibilidad
| sort disponibilidad

This returns in this result


/accounts/v1/credit_lines/0205087584/transactions 0
/accounts/v1/credit_lines/0205202927/transactions 0
/accounts/v1/credit_lines/0207414358/transactions 0
/accounts/v1/credit_lines/0207440484/transactions 0
/accounts/v1/credit_lines/0209367114/transactions 0
/accounts/v1/credit_lines/0210909021/transactions 0
/accounts/v1/credit_lines/0210997318/transactions 0
/accounts/v1/credit_lines/0211293790/transactions 0
/accounts/v1/credit_lines/0213211449/transactions 0
/accounts/v1/credit_lines/0213285496/transactions 0
/accounts/v1/credit_lines/0213523143/transactions 0
/accounts/v1/credit_lines/0214261457/transactions 0
/authentication/v1/mfa/168831676/otp 0
/clients/v1/clients/165839218/reward_points 0
/clients/v1/clients/121049368 50
/clients/v1/clients/166947472

What I want is to group by endpoint, example "/accounts/v1/credit_lines", "/authentication/v1/mfa", "/clients/v1/clients/" and see all the transactions, not separated.

Please your help, Thanks in advance

[richgalloway · Accepted solution]

This should help.

sourcetype="api-core" 
| rename request.body{}.value.request.http_status_code as http_req_result 
| convert num(http_req_result) as http_res 
| where http_res > 0 
| rename http_res as "RequestStatus", request.body{}.value.request.endpoint as Endpoint 
| regex Endpoint="^\W\D+\w.\D+" 
| rex field=Endpoint "(?<ep>\/\w+\/\w+\/\w+)"
| stats count(eval(RequestStatus>0)) as total, count(eval(RequestStatus>200)) as errors by ep
| eval disponibilidad=(100-(errors/total*100)) 
| eval disponibilidad = round(disponibilidad,0) 
| rename ep as Endpoint
| table Endpoint, disponibilidad 
| sort disponibilidad

[dnavia29]

It worked perfectly thanks, is this still doing something in the search "| regex Endpoint="^\W\D+\w.\D+" ? because I tried this regular expression and worked but didn't cut the rest of the endpoint like yours did, "| rex field=Endpoint "(?\/\w+\/\w+\/\w+)", can you break it down for me en explain it? thank you so much

[richgalloway]

The regex command is a filter. It merely allows or blocks events based on the provided regular expression.
The rex command is for field extraction ("cutting"). It also uses regular expressions, but any named capture groups in the regex become fields in the event.

[dnavia29]

Ok I understand, thank you so much for your help