Splunk Search

url search and chart

tven7
Path Finder

I have a bunch of uris to extract and categorize. And after that i need to timechart it by category.

so say the log has

/urlxyz/123/
 /urlxyz/345/
 /urlabc/123/
 /urlabc/345/

I need to extract the uris starting with urlxyz as category1 and urlabc as category 2 and timechart them as column/stacked. On the chart the categories should be the information displayed when a mouseover happens on any of the stacks.

right now my search is like this.

index=xyz sourcetype=xyz GET |rex ="GET|POST\s+(?P[^ ]+?)\s+HTTP"|timechart span=10m count(URL) by URL useother=false usenull=false

any help is appreciated. thank you.

0 Karma

lguinn2
Legend

Okay, I see one problem with this search: you define a field named "url" in the rex command, but you use it as "URL" in the timechart command. Field names are case-sensitive.

Assuming that your regular expression is correct in the rex command:

index=xyz sourcetype=xyz GET |rex ="GET|POSTs+(?P<url>[^ ]+?)s+HTTP"|timechart span=10m count by url useother=false usenull=false

should work. Note that I also changed count(URL) to just count
You do not need to count(url) if all events have the url field.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...