Splunk Search

I need to split the requestPath eliminating the data

vijaysubramania
Path Finder

Hi,

Need one Help. I have the below mentioned requestPath where I am able to capture the whole path..But can't take a count if there is different Div ID and Account No. I just to extract only
"/ecp/stream/v1/purchase/" and make a count of it. so that I can get the different response status

"requestPath":"/ecp/stream/v1/purchase/NTX.8160/8260180902213447","responseStatus":204,"responseSize":0,"responseContent":"","responseTime":27} Show syntax highlighted

rex field=_raw "requestPath":"(?<reqPath>[^?|^\s|^"]+)"

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this regex.

... | rex "requestPath":"(?<reqPath>(?:\/[^\/]+){4})"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this regex.

... | rex "requestPath":"(?<reqPath>(?:\/[^\/]+){4})"
---
If this reply helps you, Karma would be appreciated.

vijaysubramania
Path Finder

Thanks Rich..I tried the option you gave me. but it's didn't display the request Path nor trimmed it.

 My Search "requestPath":"/ecp/stream/v1/purchase*" | rex "requestPath":"(?<reqPath>(?:\/[^\/]+){4})" | stats count by reqPath.

 

I can see the events but it's not extracting

vijaysubramania_0-1593063482889.png

 

0 Karma

yeahnah
Communicator

Hi @vijaysubramania 

The answer provided by @richgalloway is mostly correct but you'll need to backslash escape the double quotes.  Here's a run anywhere example of what I mean.

| makeresults | eval _raw="requestPath\":\"/ecp/stream/v1/purchase/NTX.8160/8260180902213447"
| rex  "requestPath\":\"(?<reqPath>(?:\/[^\/]+){4})"
| stats count by reqPath

 Hope this helps.

Tags (1)

vijaysubramania
Path Finder

Got it..Thank you very much Rich and Yeahnah 🙂

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...