Splunk Search

How to get different URIs in different fields using eval command?

gibbs
New Member

I have a URI field that contains call to different APIs like:

http://mydomain.com/A/v1/*
http://mydomina.com/B/v1/*
http://mydomina.com/C/v1/*

How can i use Splunk, maybe eval, to store calls to an API in a variable, B in another variable and so on?

0 Karma

gibbs
New Member

Hi All,

I wanted to plot a time chart of the count of requests hitting different APIs. This worked for me.

source="*" earliest=-1@d | 
eval aRequests=mvfilter(match(request_uri,"http://mydomain.com/A/v1/*")) |
eval bRequests=mvfilter(match(request_uri,"http://mydomain.com/B/v1/*")) |
eval cRequests=mvfilter(match(request_uri,"http://mydomain.com/C/v1/*"")) |
timechart count(aRequests) count(bRequests) count(cRequests) 
0 Karma

niketn
Legend

@gibbs what does the event data look like. Can you add a mock? Also like somesoni2 asked... what is your use case once you get API calls as url extracted in a field?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

gibbs
New Member

Hi All,

I wanted to plot a time chart of the count of requests hitting different APIs. This worked for me.

source="" earliest=-1@d |
eval aRequests=mvfilter(match(request_uri,"http://mydomain.com/A/v1/
")) |
eval bRequests=mvfilter(match(request_uri,"http://mydomain.com/B/v1/*")) |
eval cRequests=mvfilter(match(request_uri,"http://mydomain.com/C/v1/*"")) |
timechart count(aRequests) count(bRequests) count(cRequests)

0 Karma

niketn
Legend

@gibbs.. You should convert your comment as answer and accept the same.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

DalJeanis
Legend

What do you mean when you say "to store calls"?

Storing the fact that you made a call, or storing the language for the call itself, or something else?

0 Karma

somesoni2
Revered Legend

Do you want to create a new field which contain the value A, B, C etc from the URI??

0 Karma

gibbs
New Member

Hey,

I used to mvfilter along with match to get this.

I wanted separate fields for A,B, C..... Is there any other way to do this?

0 Karma

somesoni2
Revered Legend

There may be, depending upon the what the final output that you to achieve. If you just want to add a separate field with those values without any reporting command that your eval is the way to go. If you're creating some other report, there might be other ways. If you could share your search/requirement/mock output, we can have a look.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...