Splunk Search

How to get different URIs in different fields using eval command?

gibbs
New Member

I have a URI field that contains call to different APIs like:

http://mydomain.com/A/v1/*
http://mydomina.com/B/v1/*
http://mydomina.com/C/v1/*

How can i use Splunk, maybe eval, to store calls to an API in a variable, B in another variable and so on?

0 Karma

gibbs
New Member

Hi All,

I wanted to plot a time chart of the count of requests hitting different APIs. This worked for me.

source="*" earliest=-1@d | 
eval aRequests=mvfilter(match(request_uri,"http://mydomain.com/A/v1/*")) |
eval bRequests=mvfilter(match(request_uri,"http://mydomain.com/B/v1/*")) |
eval cRequests=mvfilter(match(request_uri,"http://mydomain.com/C/v1/*"")) |
timechart count(aRequests) count(bRequests) count(cRequests) 
0 Karma

niketn
Legend

@gibbs what does the event data look like. Can you add a mock? Also like somesoni2 asked... what is your use case once you get API calls as url extracted in a field?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

gibbs
New Member

Hi All,

I wanted to plot a time chart of the count of requests hitting different APIs. This worked for me.

source="" earliest=-1@d |
eval aRequests=mvfilter(match(request_uri,"http://mydomain.com/A/v1/
")) |
eval bRequests=mvfilter(match(request_uri,"http://mydomain.com/B/v1/*")) |
eval cRequests=mvfilter(match(request_uri,"http://mydomain.com/C/v1/*"")) |
timechart count(aRequests) count(bRequests) count(cRequests)

0 Karma

niketn
Legend

@gibbs.. You should convert your comment as answer and accept the same.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

What do you mean when you say "to store calls"?

Storing the fact that you made a call, or storing the language for the call itself, or something else?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Do you want to create a new field which contain the value A, B, C etc from the URI??

0 Karma

gibbs
New Member

Hey,

I used to mvfilter along with match to get this.

I wanted separate fields for A,B, C..... Is there any other way to do this?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

There may be, depending upon the what the final output that you to achieve. If you just want to add a separate field with those values without any reporting command that your eval is the way to go. If you're creating some other report, there might be other ways. If you could share your search/requirement/mock output, we can have a look.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...