Thank you !!! This worked fine. ... View more

Thanks Ayn. The first query you have is not giving any data. You have SessionID which is not a filed in our system. You meant Hybris_SessionID? if i have that, it is complaining that "The output field 'Hybris_SessionID' cannot have the same name as a group-by field." sourcetype=access_combined_wcookie host="prlws*" | stats list(req_time) as req_time, list(Hybris_SessionID) as Hybris_SessionID, list(status) as status, list(uri) as uri by SessionID where mvfind(status,"^404$") AND mvfind(uri,"checklogin") ... View more

Thank you Ayn. This is helpful. But we are trying to see all the events along with those when there are failures happend in a cleaner fashion. Any suggestions? ... View more

Thank you for the suggestions and explanation. jtrucks. ... View more

Hi Ayn, Thanks for your reply. Actually i was using the way you suggested and thought of using regex. I am wondering how this is working - clientip="^(?:10..+|167.115..+|192.168..+|63.85.50.241)" (which gives ips does not start with those). You said search does not support regex. when we have query like this clientip="10." OR clientip="16.115.", i am thinking * is regex right? ... View more

Thank you Kristian. the pattern i gave is uri and it always starts with / so that is why i had ^. So if i wanted to start with should i just add ^ at the beginning for the regex expression. When i use the regex you have given, i am getting /mobile/m/shared/css/global.css /js/grainger/addtocartajax.js which is not the format i am looking for (/B387_38.css or /Globalfile.js). Do you know what to change? ... View more

i define pattern as having different parameters (not worried about neither the order of the parameters as long as they are same parameters nor the values of them). So that is why i said 1,2,4,5 are one pattern (same parameters but different values. Even if same values also i am fine). number 3 is another pattern, number 6 and 7 are different patterns. 8 and 10 are same pattern, 11 and 12 are same pattern etc. ... View more

This is the continuation. i could not put it in a single comment. ^/([^/]\w+/static[^.]) starts with / and not / and then one or more word characters then /static followed by not \ and any character I am guessing that expression is for capturing the below line? /Company/static.jsp?page=fos_ads.html; if so, after / we have Company which are word characters. So why do you also have ^/ Also after /static we have .jsp?page=fos_ads.html; but in the expression we only have /static[^.] This means after /static not \ and then any character. But we have more characters right? ... View more

Hi, if you don't mind i will explain what i understood. can you pls correct me? /(([\w\d_-&]+.(?:jsp|html|shtml|xml|mht))).{0,};$ one or more characters of any word, digit, _ and - followed by . and then either of jsp or html, etc and then any character 0 to infinite times. question for this expression is: why can't we use .{0,} instead of [\w\d_-&]+ Also what is the significance of () (ecatalog).{0,}; Not sure why you have () around ecatalog. looks like any characters should be preceeded by ecatalog? ... View more

Thanks for your help on this. Trying to understand what you wrote here..why do you have .{0,};$.Sorry not very familiar with regex. ... View more

I could not send my info as a comment (as there are some restrictions on the characters), so i have added as answer to workaround this. ... View more

Sorry Ayn and Kristian for not being clear. Looks like these are some vanity urls which will be called as a result of some redirect rules. Kristian as you said, they want to get a count of part of these urls. What i observed is, there is no common pattern to write splunk query. But may be you can think of some other way? They need something like the below format. part of uri count start.shtml 608 items/count 2000 ecatalog 500 i tried something like this but it is not giving me aggregated numbers.. sourcetype=accesscombinedwcookie host=prgwc* (uripath=/company/static.jsp OR uripath=/wwg/start.shtml OR uri_path=/catalog/* OR uripath=/company/items/*) | stats count by uripath Here are some examples from Logs. Set of examples for getting the count for start.shtml 70.89.56.230 - - [06/May/2013:10:06:38 -0500] "GET /company/wwg/start.shtml HTTP/1.1" 200 17313 914097 "-" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31" "-" "GIS" "Yes" sourcetype=accesscombinedwcookie Options| source=/local/www/gcom/apache2/logs/access_log.20130506 Options| host=prgwc03 BVProdWeb Options 204.153.104.254 - - [06/May/2013:10:06:38 -0500] "GET /company/wwg/start.shtml HTTP/1.1" 200 17368 5560983 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)" "-" "GIS" "Yes" set of examples for getting company/items count 38.101.184.210 - - [06/May/2013:10:06:24 -0500] "GET /company/items/1DYE3?cmsp=IO--Home--TPSELL&cmvc=HPTSZ3 HTTP/1.1" 301 20 22561 "http://www.company.com/company/wwg/homepage.jsp?time=Mon+May+06+10%3A05%3A59+CDT+2013" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" "cchiadfjkiijjkkcefeceemdfnfdfoj.0:@@@@0483729929.1367852758@@@@" "GIS" "Yes" sourcetype=accesscombinedwcookie Options| source=/local/www/gcom/apache2/logs/accesslog.20130506 Options| BVSessionID=1367852758 Options| host=prgwc04 BVProdWeb 146.217.200.214 - - [06/May/2013:10:06:27 -0500] "GET /company/items/6FXH4?cmsp=IO--Home--TPSELL&cmvc=HPTSZ3 HTTP/1.1" 301 20 13936 "http://www.company.com/company/wwg/start.shtml?firstTime=no&BVUseBVCookie=no&time=Mon+May+06+10%3A05%3A17+CDT+2013" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31" "ccfjadfjkkhieimcefeceemdfnfdglf.0:@@@@1320788453.1367852718@@@@" "GIS" "-" sourcetype=accesscombinedwcookie Options| source=/local/www/gcom/apache2/logs/accesslog.20130506 Options| BV_SessionID=1367852718 Options| host=prgwc03 BVProdWeb Set of examples for getting ecatalog count 70.192.205.10 - - [06/May/2013:10:06:38 -0500] "GET /company/digital-multimeters/electrical-power-testing/test-instruments/ecatalog/N-b98Z1z0r51d?Ndr=basedimid10071&itemsPerPage=60&sst=subset HTTP/1.1" 200 35288 992477 "http://www.company.com/company/digital-multimeters/electrical-power-testing/test-instruments/ecatalog/N-b98Z1z0r51d" "Mozilla/5.0 (Windows NT 5.1; rv:20.0) Gecko/20100101 Firefox/20.0" "-" "-" "-" 24.173.80.206 - - [06/May/2013:10:06:38 -0500] "GET /company/general-purpose-ac-motors/motors/ecatalog/N-ls1?Ndr=basedimid10071&sst=subset HTTP/1.1" 200 32103 1008898 "http://www.company.com/company/motors/ecatalog/N-bii" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" "-" "-" "-" ... View more

Thank you. When you have it can you please let me know? also it would be best if user don't have to login to view the dashboards. Not sure if that is possible or not. ... View more

Thank you Kristian ... View more