I am very new to Splunk.
I have an access.log file, which contains the Url and querystring:
url queryString
http://host/getOrder id=1&id=2&id=3
http://host/getUser id=1&id=2
http://host/getUser id=2&id=3
How could I count the url using the occurrence of "id" in the queryString?
So the result I want would be
Url IdCount
Thanks in advance
See this demo example using your data
| makeresults
| eval _raw="url,queryString
http://host/getOrder,id=1&id=2&id=3
http://host/getUser,id=1&id=2
http://host/getUser,id=2&id=3"
| multikv forceheader=1
| table url queryString
| rex field=queryString max_match=0 "id=(?<id>\d+)"
| eval ids=mvcount(id)
| stats sum(ids) as ids by url
What you want is from the rex statement down. This will
Hope this helps
See this demo example using your data
| makeresults
| eval _raw="url,queryString
http://host/getOrder,id=1&id=2&id=3
http://host/getUser,id=1&id=2
http://host/getUser,id=2&id=3"
| multikv forceheader=1
| table url queryString
| rex field=queryString max_match=0 "id=(?<id>\d+)"
| eval ids=mvcount(id)
| stats sum(ids) as ids by url
What you want is from the rex statement down. This will
Hope this helps
It works. Thanks again.