I need to split the requestPath eliminating the data

[vijaysubramania]

Hi,

Need one Help. I have the below mentioned requestPath where I am able to capture the whole path..But can't take a count if there is different Div ID and Account No. I just to extract only
"/ecp/stream/v1/purchase/" and make a count of it. so that I can get the different response status

"requestPath":"/ecp/stream/v1/purchase/NTX.8160/8260180902213447","responseStatus":204,"responseSize":0,"responseContent":"","responseTime":27} Show syntax highlighted

rex field=_raw "requestPath":"(?<reqPath>[^?|^\s|^"]+)"

[richgalloway · Accepted solution]

Try this regex.

... | rex "requestPath":"(?<reqPath>(?:\/[^\/]+){4})"

[vijaysubramania]

Thanks Rich..I tried the option you gave me. but it's didn't display the request Path nor trimmed it.

 My Search "requestPath":"/ecp/stream/v1/purchase*" | rex "requestPath":"(?<reqPath>(?:\/[^\/]+){4})" | stats count by reqPath.

I can see the events but it's not extracting

[yeahnah]

Hi @vijaysubramania 

The answer provided by @richgalloway is mostly correct but you'll need to backslash escape the double quotes.  Here's a run anywhere example of what I mean.

| makeresults | eval _raw="requestPath\":\"/ecp/stream/v1/purchase/NTX.8160/8260180902213447"
| rex  "requestPath\":\"(?<reqPath>(?:\/[^\/]+){4})"
| stats count by reqPath

 Hope this helps.

[vijaysubramania]

Got it..Thank you very much Rich and Yeahnah 🙂