This sounds like a job for a lookup (which I learned about only not too long ago myself)!
Instead of having the F5 Irules in an index, can you make it a .csv? Stick it under your $SPLUNK_HOME/etc/system/lookups if you can.
This way, you can do something like this:
source=web_logs [|inputlookup f5irule.csv | search VERB=starts_with | rename URI as cs_uri_stem] | stats count(cs_uri_stem) by cs_uri_stem
This will load up the csv, search for your starts with, returns URI as cs_uri_stem.. and then searches your web logs for that cs_uri_stem and does the counting you need.
This is just off the top of my head, I haven't got a way to test it.
Brian
... View more