A quick regex should do the trick: | rex field=req_url "(?<url_base>[^\?]+)" So your full query will be: source="Log.txt" resp_status=503 | rex field=req_url "(?<url_base>[^\?]+)" | chart count by url_base ... View more

You may need to increase time frame slightly , and use any of splunk aggregation commends. Ex: index=my_index action=POST user=* | transaction user maxspan=30s|where eventcount > 100 This will aggregate the events happened in 30 sec window and filter the users which has more then 100 POST requests. ... View more

Thre is more than one way as in Perl 😉 source="/export/home/gpiadmin/logs/access_log" NOT (" 200 Bytes" OR" 301 Bytes" OR" 302 Bytes")|... or source="/export/home/gpiadmin/logs/access_log" NOT " 200 Bytes" NOT " 301 Bytes" NOT " 302 Bytes"|... or even source="/export/home/logs/access_log" | rex ".*?HTTP\/\d+\.\d+\" (?<status_code>\d+)"|chart count by status_code | search NOT( status_code=200 ORstaus_code=301) ... View more

See if this works (run anywhere sample based on your data) | gentimes start=-1 | eval temp="Time Taken: 937534 URL_STRING: /account/signin.jsp 95.104.163.4 - - [27/Jul/2015:02:10:34 -0700] \"GET /account/signin.jsp?PRODUCT%3C%3Eprd_id=845524446072891&FOLDER%3C%3Efolder_id=2534374304776473&bmUID=kX4Nj97 HTTP/1.1\" 200 Bytes: 97413 \"http://www.xxx.com/shop/dept_category.jsp?productSizeSelected=0&pageClicked=0&PRODUCT%3C%3Eprd_id=845524446072891&FOLDER%3C%3Efolder_id=2534374306291898&bmUID=kX4NaK4\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.152 YaBrowser/15.6.2311.5029 Safari/537.36\"" | table temp | rename temp as _raw | rex "Time Taken: (?<TimeTaken>\d+)([^\"]+)\"([^\"]+)\" (?<ResponseCode>\d+)" ... View more