Splunk Search

Splunk newbie question

ncorchado
Explorer

Given my apache access_log URI is /Foobar/FoobarServices, I want to extract Foobar only for my timechart. makemv delim="/" allowempty=t uri returns Foobar and FoobarServices. All I want is the Foobar. How do I do that?

makemv delim="/" allowempty=t uri | timechart count by uri

Thanks!

0 Karma
1 Solution

ncorchado
Explorer

Got it
sourcetype="access_combined" | rex field=uri "^/(?.+?)/" | timechart count by JVM
Thanks!

View solution in original post

dmaislin_splunk
Splunk Employee
Splunk Employee

Cool, please accept the answer and select the up arrow then.

0 Karma

ncorchado
Explorer

Got it
sourcetype="access_combined" | rex field=uri "^/(?.+?)/" | timechart count by JVM
Thanks!

View solution in original post

dmaislin_splunk
Splunk Employee
Splunk Employee

Did you get a new field on the left called newfield with this information?

0 Karma

ncorchado
Explorer

Yes. I tried your recommendation and I still get /Foobar/FoobarServices. I just want to capture Foobar.

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Are you just trying to extract information between the / and create a new field?

sourcetype="access_combined" | rex field=uri "^/(?.+?)/"

Something like this?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!