extract URI_Stem and combine based on lowest path

[dragon98902072]

Hey all

I have some IIS extractions that are pulling the field cs_uri_stem from my IIS 7.0-8.0 logs.

I am trying to group stats and totals by common paths at the URI stem level.

EX:

applications/application1/*

applications/application2/*

However the full URI stem will all count differently even using folderize and dedup in my base search.

I would like to ultimately limit this field to say 3 separators or /// that should get me my main application folder and collect all stats under this into the correct application root.

Anyone have any ideas?

Side note, My instance is the cloud version so i do not have access to transforms.

Thanks

[dragon98902072 · Accepted solution]

figured out a regex extraction that gives me what i need. see the below that will create 2 new fields root and app that can be used to group stats by either level. The following will take the total size files serverd and group by the second section of the URI (APP)

cs_uri_stem=* sc_bytes>0  | rex field=cs_uri_stem "^/(?<root>.+?)/(?<app>.+?)/" | chart sum(sc_bytes) by app | top limit=25 sum(sc_bytes) by app