About mcscjlf

mcscjlf · ‎07-14-2022

Hello, In my search I'm trying to get a series of events (transact - which is in the _raw field) counted out by another field in _raw for GET or POST. This is what I'm currently using: host="EXAMPLE-*" sourcetype=Hex4 /ps/* | rex mode=sed field=_raw "s/(\S+)(tx_\S+)(\/\S+)/\1trans\3/g" | rex mode=sed field=_raw "s/(\S+)(nce_\S+)(\/\S+)/\1nce\3/g" | rex mode=sed field=_raw "s/(\S+)(dce_\S+)(\/\S+)/\1dvc\3/g" | rex "POST (?<transact>\S+)" | stats count(eval(method="GET")) as GET, count(eval(method="POST")) as POST by transact It does bring up the transactions and columns for GET and POST, but the counts are blank so I know I'm doing something wrong. Any help would be greatly appreciated! Thank you!

mcscjlf · ‎07-12-2022

Thanks for the suggestions! Unfortunately, neither worked. I am trying to change this data in the search and only for the search results, I don't want to permanently change the underlying data. Perhaps my other search criteria is affecting the results with the solutions provided. Search Criteria: host="Example" sourcetype=Hexflag2 /fi/transaction/* | rex "POST (?<transact>/S+)" | stats county by transact This returns the example data below, I'm just hoping for a way to condense all of the unique values to something I can rollup into a usage count.

mcscjlf · ‎07-11-2022

This worked perfectly, thank you!!

mcscjlf · ‎07-11-2022

Hello, I have several events in the _raw field that add a unique identification number. I would like to replace these with something standard to aggregate counts on. Example Data: fi/transaction/card/purchase/tx_2994882028948/refund fi/transaction/card/purchase/tx_3920496893002/void fi/transaction/card/purchase/tx_2930540482198/refund I'd like these all to read: fi/transaction/card/purchase/trans/refund fi/transaction/card/purchase/trans/void fi/transaction/card/purchase/trans/refund So replace the unique identifier, but maintain the verbiage at the end. I've tried a few of the other methods noted in other threads, but to no avail. Some don't work at all, some run, but don't replace the values. Thanks!!

mcscjlf · ‎07-08-2022

I don't have a ton of experience with Splunk yet but I've been asked to find API endpoints (which appear to be in our raw data) and see how often their being used. Example Events: | 2022-07-08 05:59:06 21.30.2.80 POST /api/transact/credit/sale 5051 - 571.232.505.62 okhttp/3.18.9 | 2022-07-08 05:02:01 22.35.3.79 POST /api/transact/device 6062 - 641.141.323.82 okhttp/2.15.3 What I want to end up with is the api and a count: /api/transact/credit/sale 3,475 /api/transact/device 275 Is this possible? Thank you!!

Posts	5
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎07-08-2022

Online Status	Offline
Date Last Visited	‎07-13-2022 12:30 AM

Search Stats with _raw field

How to replace Unique Values?

How to calculate Raw data for API endpoints and co...

Search Stats with _raw field

Re: How to replace Unique Values?

Re: How to calculate Raw data for API endpoints an...

How to replace Unique Values?

How to calculate Raw data for API endpoints and co...