Dynamic grouping of results

[aalvino]

I am using splunk to ingest haproxy logs. Our HAproxy forwards requests onto a number of different servers for access to various APIs. Currently I have some reports to find the average repsonse times, 95th percentile etc for these different API calls. The current reports do searches on strings for the APIs and to generate the report. The API strings are hard coded in the reports. For example here is the framework of one of the reports:

sourcetype=haproxy:http status=200 ("api1_string?" OR "api2_string?" OR "api3_string?" OR "api4_string?" ) | eval API=case(searchmatch("api1_string?"),"api1",
searchmatch("api2_string?"),"api2",
searchmatch("api3_string?"),"api3",
searchmatch("api4_string?"),"api4",
true(),"unknown")
|stats avg(rtt) as AveragePerRequest, perc95(rtt) as 95thPercentile, count as Count by API | eval AveragePerRequest=round(AveragePerRequest,2)

Ideally I could have the strings for the searchmatches and the original search created dynamically.
The field to be evaluated for the api calls is the http_request field from the haproxy log. A couple of examples of

GET /path1/API?option1=answer2&option2=answer2 HTTP/1.1
POST /path1/path2/path3/path4/API HTTP/1.1

So basically the API will be the last path in the http_request dropping the query parameters that come after the ? if there.

So is it possible to dynamically generate the list of APIs for feeding into the report?

I have reviewed quite a bit of documentation, but I have not found anything that might help with this.

[aalvino · Accepted solution]

I have been able to get this working as I need. Here is what I did incase anyone else is looking to do something similar:

sourcetype=haproxy:http status=200|
eval temp=mvindex(split(http_request,"/"),-2) |
eval temp2=mvindex(split(temp,"?"),0) |
eval api=mvindex(split(temp2," "),0) | fields rtt api |

eventstats perc95(rtt) as p95Resp by api|
eval p00Unit=1 |
eval p95Response=if(rtt<=p95Resp,rtt,null()) |
stats count(p00Unit) as Count, avg(rtt) as Average avg(p95Response) as 95PercentileAvg perc95(rtt) as 95thPercentile count(p95Unit) as 95thPercentileCount by api
| foreach 95PercentileAvg 95thPercentile Average [eval <>=round('<>',2)] | sort -num(Count)