- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Regex string end of the url and in between
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10.1.151.100 [18/May/2018:09:09:57 +0200] "GET http://example.com/DCQ/templates/GetAggregated?channel=TV&contentId=4ek4k4&lang=eng HTTP/1.1" 200 2856 hit 0.000111 hit - 154.176.135.239
10.1.51.16 [18/May/2018:09:20:42 +0200] "GET http://video-play.vodacom.co.za/AVS/besc?action=GetIsFavorite&channel=IPHONE&contentId=1200668 HTTP/1.1" 200 113 miss 0.007757 miss - 19.392.33.103
10.1.51.16 [18/May/2018:08:37:51 +0200] "GET http://example.com/AVS/besc?username=00007&channel=ANDROID&action=GetAccountList HTTP/1.1" 200 1516 miss 0.030941 miss - 203.122.32.11
I tried this but it does not print the ones with action=<> that are at the end of the url.
index=index-name_idx earliest=-1h | rex "(?i)action=(?P[^&]+)" |stats count by test
index=index-name_idx earliest=-1h | rex "(?i)action=(?P[^&]+|[\s]+)" |stats count by test
The result i get is:
CheckSession 444
DeleteFavourite 1
GetAccountList 116
GetAccountList HTTP/1.1" 200 1516 miss 0.030941 miss - 119.92.253.103 1
GetAccountList HTTP/1.1" 200 1898 miss 0.029884 miss - 119.92.253.103 1
GetAccountList HTTP/1.1" 200 1902 miss 0.023020 miss - 119.92.253.103 1
I want result for action=<> anything sorted by channel= and count but the key action could be anywhere in the URL and hence i dont get the exact count.
How do we use regex to find action=<> if it is at the end of the URL.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@panandshah, please use the Code button ie. button with 101010 or shortcut key CTRL+K while posting data or code so that special characters do not escape.
Based on the data sample provided, can you try the following regex?
index=index-name_idx earliest=-1h |
| rex "action=(?<action>[^\&\s]+)[&|\s]"
What is the action field in the first example is there a pattern for that?
Also the third data has channel=ANDROID∾tion=GetAccountList is the ∾ character actually present in your raw data or is it due to copy paste and the character is actually ac.?
Do you need to extract channel as well?
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@panandshah, please use the Code button ie. button with 101010 or shortcut key CTRL+K while posting data or code so that special characters do not escape.
Based on the data sample provided, can you try the following regex?
index=index-name_idx earliest=-1h |
| rex "action=(?<action>[^\&\s]+)[&|\s]"
What is the action field in the first example is there a pattern for that?
Also the third data has channel=ANDROID∾tion=GetAccountList is the ∾ character actually present in your raw data or is it due to copy paste and the character is actually ac.?
Do you need to extract channel as well?
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That works indeed!! Thanks
Announcing Scheduled Export GA for Dashboard Studio
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!
