I want to get an API usage report per user and I am struggling with the Splunk Query for this, can someone please help with the query, I tried using rex but didn't get through.   In my app logs, I have a text like - U87XXXX:ddddffggggggsss.REG.Currency [RestInterceptor]: RestRequest: URI : https://abc.net/api/curr ........  RequestBody: {"loginId": "U87XXXX"}   I want the output as UserID                     URL                                                 COUNT  U87XXXX        https://abc.net/api/curr                    5 U78XXXX       https://abc.net/api/xyz                     11    Thanks in advance. ... View more

I have a log in tomcat as -   ... [MerchantEndPoint]: saveMerchantDetails():ednpoint execution enterd .. ... [CreditEndPoint]: saveCreditDetails():ednpoint execution enterd -..    I want to create a chart based on the entry logs how many times service getting called /day   i have created a regex with below query but its not giving correct result, in regex editor it works fine   index=fg_wv_li | sourcetype="fg:mylogs.txt" ":endpoint execution started" | rex field=_raw "\b(?<stype>(\[]a-zA-Z]+\][:]))" | chart count by stype   i want as servicename:method name : count / day [MerchantEndPoint]: saveMerchantDetails():    10 [CreditEndPoint]: saveCreditDetails() : 15    Can someone help me to fix the query above? Thanks. ... View more