Splunk Search

I need to split the requestPath eliminating the data

vijaysubramania
Path Finder

Hi,

Need one Help. I have the below mentioned requestPath where I am able to capture the whole path..But can't take a count if there is different Div ID and Account No. I just to extract only
"/ecp/stream/v1/purchase/" and make a count of it. so that I can get the different response status

"requestPath":"/ecp/stream/v1/purchase/NTX.8160/8260180902213447","responseStatus":204,"responseSize":0,"responseContent":"","responseTime":27} Show syntax highlighted

rex field=_raw "requestPath":"(?<reqPath>[^?|^\s|^"]+)"

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this regex.

... | rex "requestPath":"(?<reqPath>(?:\/[^\/]+){4})"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this regex.

... | rex "requestPath":"(?<reqPath>(?:\/[^\/]+){4})"
---
If this reply helps you, Karma would be appreciated.

vijaysubramania
Path Finder

Thanks Rich..I tried the option you gave me. but it's didn't display the request Path nor trimmed it.

 My Search "requestPath":"/ecp/stream/v1/purchase*" | rex "requestPath":"(?<reqPath>(?:\/[^\/]+){4})" | stats count by reqPath.

 

I can see the events but it's not extracting

vijaysubramania_0-1593063482889.png

 

0 Karma

yeahnah
Communicator

Hi @vijaysubramania 

The answer provided by @richgalloway is mostly correct but you'll need to backslash escape the double quotes.  Here's a run anywhere example of what I mean.

| makeresults | eval _raw="requestPath\":\"/ecp/stream/v1/purchase/NTX.8160/8260180902213447"
| rex  "requestPath\":\"(?<reqPath>(?:\/[^\/]+){4})"
| stats count by reqPath

 Hope this helps.

Tags (1)

vijaysubramania
Path Finder

Got it..Thank you very much Rich and Yeahnah 🙂

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...