Splunk Search

How to group URLs in my sample data while ignoring "/{id}" AND OR "/logs" or "/messages/" segments?

jw44250
New Member

below example : matching employee with 100 and 800 are accessing comments url
localhost/employees/100/comments
localhost/employees/800/comments

matching 600 and 900 id having 3 messages
localhost/employees/600/messages/3
localhost/employees/900/messages/3

httpRequest
localhost/employees/100/comments
localhost/employees/200/comments/10
localhost/employees/300/logs/1
localhost/employees/400/logs/3
localhost/employees/800/comments
localhost/employees/700/logs/10
localhost/employees/600/messages/3
baseURL/employees/400/message/3

0 Karma

jw44250
New Member

okie..
what is the best way to exclude them from search result
/

/%00

/%00/

/%0a%
//
//abx
//hell/**

0 Karma

jw44250
New Member

/0960P011.png
/0l76F0VE.pfg
/1/

0 Karma

niketn
Legend

This is a duplicate question.... https://answers.splunk.com/answers/520428/how-to-group-urls-based-patterns.html#answer-519779

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...