Thanks @PrewinThomas -  it worked as expected and was fast enough. ... View more

Thanks @PickleRick  for your response. I am looking to get the count of browsers which are commonly used like chrome, firefox, safari, edge and opera ... View more

+1 on that - don't use join unless there is absolutely no other way (or you have a very small dataset). Not only it's relatively slow and resource-hungry, it has also pretty serious limitations and you can get wrong or incomplete results without knowing it. ... View more

@richgalloway  thanks. It worked. ... View more

Thanks. It worked ... View more

Thanks once again @ITWhisperer  It works as expected. ... View more

Hi, Can you provide a sample of the raw data? It's probably JSON assuming what you've posted is from Splunk's "List" view. The spath command in your search also expects _raw (by default) to be JSON. If that's the case, the fields aren't empty. They have a literal hyphen as their value. For example: {"body_bytes_sent": "0", "bytes_sent": "0", "host": "nice_host", "http_content_type": "-", "http_referer": "-", "http_user_agent": "-", "kong_request_id": "8853b73ffef1c5522b4a383c286c825e", "log_type": "kong", "query_string": "-", "remote_addr": "10.138.100.153", "request_id": "93258e0bc529fa9844e0fd2d69168d0f", "request_length": "1350", "request_method": "GET", "request_time": "0.162", "scheme": "https", "server_addr": "10.138.100.151", "server_protocol": "HTTP/1.1", "status": "499", "time_local": "25/Feb/2024:05:11:24 +0000", "upstream_addr": "10.138.103.157:8080", "upstream_host": "nice_host", "upstream_response_time": "0.000", "uri": "/v1/d5a413b6-7d00-4874-b706-17b15b7a140b"} {"body_bytes_sent": "0", "bytes_sent": "0", "host": "nice_host", "http_content_type": "-", "http_referer": "-", "http_user_agent": "-", "kong_request_id": "89cea871feba9f2d5216856f7a884223", "log_type": "kong", "query_string": "productType=ALL", "remote_addr": "10.138.100.214", "request_id": "9dbf69defb49a3595cf1040e6ab5d4f2", "request_length": "1366", "request_method": "GET", "request_time": "0.167", "scheme": "https", "server_addr": "10.138.100.151", "server_protocol": "HTTP/1.1", "status": "499", "time_local": "25/Feb/2024:05:11:24 +0000", "upstream_addr": "10.138.98.140:8080", "upstream_host": "nice_host", "upstream_response_time": "0.000", "uri": "/v1/a8b7570f-d0af-4d0d-bd6d-f6cf31892267"} You can search for the literal value directly: query_string=- or query_string="-" There is a caveat: the hyphen is a minor breaker and isn't indexed by Splunk as a term. All events will be returned initially, the query_string field will be extracted, and its value will be scanned for a hyphen to filter results. If your JSON fields aren't auto-extracted, we can investigate your inputs.conf and props.conf settings. ... View more

Its working as expected. Thank you @ITWhisperer  ... View more

@ITWhisperer  there was an issue in my search parameter of my SPL which I fixed. it is now returning count as expected. Apart from that no change in the stats part of the query | stats count as hits avg(processDuration) as average perc90(processDuration) as response90 by Operations Thank you once again   ... View more

Thanks @yeahnah  it worked.  \= ... View more

@ITWhisperer  - Thanks.  It is now returning the expected pattern alone. ... View more

Thanks @ITWhisperer  the query worked as expected. However I have 1 more pattern of search text to include. From the below: "message":{"input":"192.168.62.10 - - [06/Apr/2023:05:45:51 +0000] \"GET /shopping/carts/v1/e5aa581b-ac7a-40f5-a8da-8ab5cb51039c/summary HTTP/1.1\" 200 636 8080 13 ms"} "message":{"input":"192.168.54.47 - - [06/Apr/2023:04:08:13 +0000] \"GET /shopping/carts/v1/734b2f55-c304-49a5-baa9-8e9994495b55 HTTP/1.1\" 200 1855 8080 10 ms"} "message":{"input":"192.168.54.47 - - [06/Apr/2023:04:08:13 +0000] \"GET /shopping/carts/v1/734b2f55-c304-49a5-baa9-8e9994495b55/product HTTP/1.1\" 200 1855 8080 10 ms"} "message":{"input":"192.168.54.47 - - [06/Apr/2023:04:08:13 +0000] \"GET /location-context/stations/v1/CJS?module=ONLINE_BOOKING&requestedPoint=DESTINATION HTTP/1.1\" 200 1855 8080 10 ms"} From the above, I am interested to extract only the orange highlighted string eg:  GET /shopping/carts/v1/<ending with any id alone> HTTP   I tried with below splunk query as intermediate step to extract the urls: index=my_index openshift_cluster="cluster009" sourcetype=openshift_logs openshift_namespace=my_ns openshift_container_name=contaner | rex field=message.input "(?<servicename>(?:[^\"]|\"\")*HTTP)" | dedup servicename | stats count by servicename But this returns the all pattern. GET /shopping/carts/v1/e5aa581b-ac7a-40f5-a8da-8ab5cb51039c/summary HTTP GET /shopping/carts/v1/734b2f55-c304-49a5-baa9-8e9994495b55 HTTP (I need only this) GET /shopping/carts/v1/734b2f55-c304-49a5-baa9-8e9994495b55/product HTTP GET /location-context/stations/v1/CJS?module=ONLINE_BOOKING&requestedPoint=DESTINATION HTTP ... View more

Hello @scelikok  thanks actually the query shared by you works. I overlooked the last bit of the search hence the confusion. ... View more

Hi @super_edition, in the first search, you have to add the command addcoltotals (https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Addcoltotals) at the end of the search to sum al the values: (index=index_1 OR index=index_2) sourcetype=openshift_logs openshift_namespace="my_ns" openshift_cluster="*" | spath "message.url" | search "message.url"="/dummy/url/v1*" "message.tracers.ke-channel{}"="*" "message.jsonObject.payments{}.products{}.type"=GROCERY "message.statusCode"<400 | rename "message.jsonObject.payments{}.orderStatus.status" AS "ORDER_STATUS" | top limit=50 "ORDER_STATUS" | addcoltotals count labelfield="ORDER_STATUS" label="Total Count" then don't use dedup when you have to make a sum of values because using dedup (as @manjunathmeti said) you lose some values. Then, don't put search terms in different search commands because in this way your search is slower: put all search terms in the same search command or (if possible) in the main search. Ciao. Giuseppe ... View more