How to search a list of URLs and add the response times for URLs with similar patterns?

[Karan_Jindal]

Hi,

I have a Splunk search which gives list of URLs and their corresponding response times like:

/webapp/store/p/product1, 1
/webapp/store/p/product2, 2
/webapp/store/p/product3, 1
/webapp/store/l/list1, 1.12
/webapp/store/l/list2, 0.12
/webapp/store/home, 1.12
/webapp/store/page4, 1.12
/webapp/store/page5, 1.12

Now, I want to do a pattern search on these urls and want to add the response times of similar patterned urls.

Desired output:

/webapp/store/p/, 4
/webapp/store/l/, 1.24
/webapp/store/home, 1.12
/webapp/store/page4, 1.12
/webapp/store/page5, 1.12

Any help would be appreciated.

Thanks

[richgalloway]

This should get you started:

... | rex field=URL "(<?PbaseURL>\/\w+\/\w+\/\w+)" | stats sum(time) as totalTime by baseURL | table baseURL totalTime

[martin_mueller]

Try this:

base search | rex field=url "^(?<pattern>/[^/]+/[^/]+/[^/]+/?)" | stats sum(response_time) by pattern