Hi,
Need one Help. I have the below mentioned requestPath where I am able to capture the whole path..But can't take a count if there is different Div ID and Account No. I just to extract only
"/ecp/stream/v1/purchase/" and make a count of it. so that I can get the different response status
"requestPath":"/ecp/stream/v1/purchase/NTX.8160/8260180902213447","responseStatus":204,"responseSize":0,"responseContent":"","responseTime":27} Show syntax highlighted
rex field=_raw "requestPath":"(?<reqPath>[^?|^\s|^"]+)"
Try this regex.
... | rex "requestPath":"(?<reqPath>(?:\/[^\/]+){4})"
Try this regex.
... | rex "requestPath":"(?<reqPath>(?:\/[^\/]+){4})"
Thanks Rich..I tried the option you gave me. but it's didn't display the request Path nor trimmed it.
My Search "requestPath":"/ecp/stream/v1/purchase*" | rex "requestPath":"(?<reqPath>(?:\/[^\/]+){4})" | stats count by reqPath.
I can see the events but it's not extracting
Hi @vijaysubramania
The answer provided by @richgalloway is mostly correct but you'll need to backslash escape the double quotes. Here's a run anywhere example of what I mean.
| makeresults | eval _raw="requestPath\":\"/ecp/stream/v1/purchase/NTX.8160/8260180902213447"
| rex "requestPath\":\"(?<reqPath>(?:\/[^\/]+){4})"
| stats count by reqPath
Hope this helps.
Got it..Thank you very much Rich and Yeahnah 🙂