Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Query for Multiple URLs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm sure this will be easy for you guys but I"m struggling with it..
I need to modify this query to look for both the http://open/FinalNumbers as well as a URL of https://apicorp.company/open/FinalNumbers
"A GET was made to Open API - Status: OK (http://open/FinalNumbers" | spath AppID | search Environment=prod | timechart count by Environment | bin span=7d _time | stats avg(prod)
Please help!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sounds like you want to OR the URLs:
"A GET was made to Open API - Status: OK (http://open/FinalNumbers" OR "A GET was made to Open API - Status: OK (https://apicorp.company/open/FinalNumbers" | spath AppID | search Environment=prod | timechart count by Environment | bin span=7d _time | stats avg(prod)
Also before the first pipe, you should specify an index and sourcetype at a minimum for efficiency.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sounds like you want to OR the URLs:
"A GET was made to Open API - Status: OK (http://open/FinalNumbers" OR "A GET was made to Open API - Status: OK (https://apicorp.company/open/FinalNumbers" | spath AppID | search Environment=prod | timechart count by Environment | bin span=7d _time | stats avg(prod)
Also before the first pipe, you should specify an index and sourcetype at a minimum for efficiency.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks! That worked!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please "accept as answer" the solution that fixes the issue, to help others. Thanks, and glad it worked!
Splunk Observability as Code: From Zero to Dashboard
[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions
Shape the Future of Splunk: Join the Product Research Lab!
