Splunk Search

timechart of traffic v commerce

londondev
Engager

Based on example 4 at http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart I'm trying to generate a timechart of site traffic plus commerce traffic (commerce means our URL matches /Commerce/) but commerce traffic isn't returning anything. I assume there's a problem with my use of eval(uri_path=...

This is the query:
sourcetype=access_combined | timechart count(eval(method="GET")) AS GETs, count(eval(uri_path="/Commerce/*")) AS Commerce

Any ideas what I'm doing wrong?

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Your comparison in the eval command is not valid. Wildcard are not supported in a comparison using the equals sign, but are instead performed by using the match function. So, something like this should work better:

sourcetype=access_combined | timechart count(eval(method="GET")) AS GETs, count(eval(match(uri_path,"^/Commerce/"))) AS Commerce

View solution in original post

londondev
Engager

thanks Chris. "sourcetype=access_combined | top uri_path" includes '/Commerce/AIM' - looks like Ayn's answer below works though

0 Karma

Ayn
Legend

Your comparison in the eval command is not valid. Wildcard are not supported in a comparison using the equals sign, but are instead performed by using the match function. So, something like this should work better:

sourcetype=access_combined | timechart count(eval(method="GET")) AS GETs, count(eval(match(uri_path,"^/Commerce/"))) AS Commerce

londondev
Engager

thanks Ayn, this seems to work

0 Karma

chris
Motivator

Does uri_path contain any values? What does "sourcetype=access_combined | top uri_path" return? If the field extraction/recognition is ok then it should work (maybe "*/Commerce/*" will work) otherwise the fields might have to be extracted first (but you've already done that right?).

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...