Splunk newbie question

[ncorchado]

Given my apache access_log URI is /Foobar/FoobarServices, I want to extract Foobar only for my timechart. makemv delim="/" allowempty=t uri returns Foobar and FoobarServices. All I want is the Foobar. How do I do that?

makemv delim="/" allowempty=t uri | timechart count by uri

Thanks!

[dmaislin_splunk]

Cool, please accept the answer and select the up arrow then.

[ncorchado · Accepted solution]

Got it
sourcetype="access_combined" | rex field=uri "^/(?.+?)/" | timechart count by JVM
Thanks!

[dmaislin_splunk]

Did you get a new field on the left called newfield with this information?

[ncorchado]

Yes. I tried your recommendation and I still get /Foobar/FoobarServices. I just want to capture Foobar.

[dmaislin_splunk]

Are you just trying to extract information between the / and create a new field?

sourcetype="access_combined" | rex field=uri "^/(?.+?)/"

Something like this?