Splunk Search

chart over query string

New Member

Hi guys,

I have an apache log. I want to be able to chart the count of occurances of a particular query string in the uri_path.

eg.

/path/file?q1=v1&q2=v2&q3=v3
/path/file?q1=v3&q2=v1&q3=v2
/path/file?q1=v2&q2=v3&q3=v1

I want to get:

uri_path   count
q2=v1      63
q2=v2      26
q2=v3      82

I've worked out how to regex on the query string, but I can't work out how to chart count over specific q2 values of uri_path and ignore changes in q1 and q3.

0 Karma
1 Solution

Splunk Employee
Splunk Employee

I'd assume that you already have the q2 field extracted automatically. You can verify that it is and search:

... | top q2

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

I'd assume that you already have the q2 field extracted automatically. You can verify that it is and search:

... | top q2

View solution in original post

0 Karma

New Member

oh, hahaha I was over thinking it. Thanks, Stephen.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!