×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
rh990
Engager
Member since: ‎08-24-2016
‎06-05-2020
Community Statistics
Posts 3
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎08-24-2016
Activity Feed
View All

Re: split url and perform a count on it.

by in Getting Data In
‎08-24-2016 01:18 PM
‎08-24-2016 01:18 PM
The special character in the field name was it. Thank you so much. I figured it was something simple, I'm just new to it. ... View more

Re: split url and perform a count on it.

by in Getting Data In
‎08-24-2016 01:02 PM
‎08-24-2016 01:02 PM
I've tried this one and I get no results for statistics when I use it. I see plenty of results for events, but nothing for statistics. index="sss" Application.AppName = "xxxx*" Header.Type=inbound | eval url=mvindex(split(Service.URL, "?"), 0) | stats count by url ... View more

split url and perform a count on it.

by in Getting Data In
‎08-24-2016 12:28 PM
‎08-24-2016 12:28 PM
You'll have to pardon the newbie question. I'm sure this is crazy easy, but I'm having the worst time figuring it out. My logs have a URL field in them and I want to split out the query string and do a count on the URL minus the query sting. I've tried a bunch of different things, but nothing I've tried has really gotten me what I'm after. An example might be like: www.nasdaq.com/symbol/?Load=true&Search=ssss www.nasdaq.com/symbol/?Load=true&Search=ddd www.nasdaq.com/symbol/?Load=true&Search=xxx www.nasdaq.com I'd like to see www.nasdaq.com/symbol/ 3 www.nasdaq.com 1 ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma given to
View All