Solved: How to get unique patterns - Page 2

xvxt006 · ‎05-24-2013

Hi, we would like to get unique query string patterns so that we can cache them at Akamai. i have written a query
rex field=uri "\?(?.*)" | dedup command | table command

Below is the output. You can see 1,2,4,5 etc are same pattern. So how do i get just the unique patterns.

1 perPage=48&requestedPage=97
2 perPage=48&requestedPage=95
3 sst=subset
4 perPage=48&requestedPage=96
5 perPage=48&requestedPage=1
6 bc=y
7 redirect=socket+set
8 searchQuery=2LDR7&fromCatalog=true
9 ta=t
10 searchQuery=2LDR8&fromCatalog=true
11 searchQuery=cable+lug
12 searchQuery=stainless+pallet

kristian_kolb · ‎05-24-2013

Hmm yes..I guess..maybe

your base search | dedup uri | rex field=uri mode=sed "s/=[^&]+/=XXX/g" | dedup uri | eval uri = substr(uri,2) | table uri

Haven't tested it, but it should replace all parameter values in the URL with 'XXX'. Yes there are 2 dedups. The first one is for reducing the number of uri's to be processed by rex. You might skip it if the uri's are almost always different.

This search does not take the order of the parameters into account, so

A=xxx&B=xxx
B=xxx&A=xxx

would be considered different.

Should hopefully work...

/K

View solution in original post

How to get unique patterns

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

.conf24 | Registration Open!

ICYMI - Check out the latest releases of Splunk Edge Processor