Splunk Search

regex for uri ignoring query params and path params.

Loves-to-Learn Lots

I am trying to find the top api url's that were consumed by our clients. Our uri in logs are of below format.

1. https://api.server.com/user/1                       (type 1)
2. https://api.server.com/user/2                       (type 1)
3. https://api.server.com/user/3/role/1        (type 2)
4 . https://api.server.com/user?name=test  (type 3)

Now i need result count for each uri like below.

/user/{id} - 2

/user/{id}/role{id}. - 1

/user   - 1  (or user {filter} for query params e.g. /user/{filter})

i have unlimited combinations of such path parameters for different resources. what is the best way to get the count of url hits.



Labels (4)
0 Karma

Ultra Champion

Without the full log entry or an example of the fields already extracted, I will have to guess that the url is either enclosed in double quotes or there is a trailing space of some kind and that the ids are all a series of digits

| rex "(?P<uri>https:\/\/api\.server\.com\/[^\?\"\s]+)"
| rex field=uri mode=sed max_match=0 "s/\/[\d]+/\/\{id\}/"
| stats count by uri


0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!