Splunk Search

I need to split the requestPath eliminating the data

vijaysubramania
Path Finder

Hi,

Need one Help. I have the below mentioned requestPath where I am able to capture the whole path..But can't take a count if there is different Div ID and Account No. I just to extract only
"/ecp/stream/v1/purchase/" and make a count of it. so that I can get the different response status

"requestPath":"/ecp/stream/v1/purchase/NTX.8160/8260180902213447","responseStatus":204,"responseSize":0,"responseContent":"","responseTime":27} Show syntax highlighted

rex field=_raw "requestPath":"(?<reqPath>[^?|^\s|^"]+)"

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this regex.

... | rex "requestPath":"(?<reqPath>(?:\/[^\/]+){4})"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this regex.

... | rex "requestPath":"(?<reqPath>(?:\/[^\/]+){4})"
---
If this reply helps you, Karma would be appreciated.

vijaysubramania
Path Finder

Thanks Rich..I tried the option you gave me. but it's didn't display the request Path nor trimmed it.

 My Search "requestPath":"/ecp/stream/v1/purchase*" | rex "requestPath":"(?<reqPath>(?:\/[^\/]+){4})" | stats count by reqPath.

 

I can see the events but it's not extracting

vijaysubramania_0-1593063482889.png

 

0 Karma

yeahnah
Communicator

Hi @vijaysubramania 

The answer provided by @richgalloway is mostly correct but you'll need to backslash escape the double quotes.  Here's a run anywhere example of what I mean.

| makeresults | eval _raw="requestPath\":\"/ecp/stream/v1/purchase/NTX.8160/8260180902213447"
| rex  "requestPath\":\"(?<reqPath>(?:\/[^\/]+){4})"
| stats count by reqPath

 Hope this helps.

Tags (1)

vijaysubramania
Path Finder

Got it..Thank you very much Rich and Yeahnah 🙂

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...