Splunk Search

I need to split the requestPath eliminating the data

vijaysubramania
Path Finder

Hi,

Need one Help. I have the below mentioned requestPath where I am able to capture the whole path..But can't take a count if there is different Div ID and Account No. I just to extract only
"/ecp/stream/v1/purchase/" and make a count of it. so that I can get the different response status

"requestPath":"/ecp/stream/v1/purchase/NTX.8160/8260180902213447","responseStatus":204,"responseSize":0,"responseContent":"","responseTime":27} Show syntax highlighted

rex field=_raw "requestPath":"(?<reqPath>[^?|^\s|^"]+)"

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this regex.

... | rex "requestPath":"(?<reqPath>(?:\/[^\/]+){4})"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this regex.

... | rex "requestPath":"(?<reqPath>(?:\/[^\/]+){4})"
---
If this reply helps you, Karma would be appreciated.

vijaysubramania
Path Finder

Thanks Rich..I tried the option you gave me. but it's didn't display the request Path nor trimmed it.

 My Search "requestPath":"/ecp/stream/v1/purchase*" | rex "requestPath":"(?<reqPath>(?:\/[^\/]+){4})" | stats count by reqPath.

 

I can see the events but it's not extracting

vijaysubramania_0-1593063482889.png

 

0 Karma

yeahnah
Motivator

Hi @vijaysubramania 

The answer provided by @richgalloway is mostly correct but you'll need to backslash escape the double quotes.  Here's a run anywhere example of what I mean.

| makeresults | eval _raw="requestPath\":\"/ecp/stream/v1/purchase/NTX.8160/8260180902213447"
| rex  "requestPath\":\"(?<reqPath>(?:\/[^\/]+){4})"
| stats count by reqPath

 Hope this helps.

Tags (1)

vijaysubramania
Path Finder

Got it..Thank you very much Rich and Yeahnah 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...