Splunk Search

How can I check for a URL query parameter NOT being passed

roryhewitt
New Member

This is a follow-on question to http://answers.splunk.com/answers/228254/how-to-search-the-total-number-of-hits-to-urls-tha.html...

I want to try to find out the number of entries in a log file which contain one parameter but do NOT contain another parameter. The parameters could be in any order.

Basically, I want to be able to differentiate between these URL's:

1. /shop/product/<somevalue>?ID=123456&CategoryID=9876 <-- Both ID and CategoryID passed
2. /shop/product/<somevalue>?CategoryID=9876&ID=123456 <-- Both ID and CategoryID passed (different order)
3. /shop/product/<somevalue>?ID=123456

where I know that ID will always be passed, but where CategoryID is optional and may be before or after ID.

I need a count of type 3 (without CategoryID) to compare with a count of types 1 and 2 combined.

I can easily parse out all the entries that match the /shop/product/* path, but can I do a single subsequent rex/regex to check for existence somewhere in the query string of the CategoryID?

I hope this is clear...

0 Karma

stephanefotso
Motivator

Hello! By following the link you gave above, i think you should use this to compare type1, and type2
count(pro_id_TY1) is the count of ID in events where there is no CategoryID, (means the last event in your sample data.)
count(pro_id_TY2) is the count of ID in events where there is a CategoryID (means, the first and the second event in your sample data)

  1. if url is a field in your events, here you go
    ........|rex field=url "^[^&\n]\?ID=(?P\d+$)"|rex field=url "^[^&\n]&ID=(?P\d+)"|rex field=url "^[^&\n]*\?ID=(?P\d+)&Category"|stats count(pro_id_TY1) count(pro_id_TY2)

    1. if url is not a field, means you are working with raw data, here yu go:

    ...|rex field=_raw "^[^&\n]\?ID=(?P\d+$)"|rex field=url "^[^&\n]&ID=(?P\d+)"|rex field=url "^[^&\n]*\?ID=(?P\d+)&Category"|stats count(pro_id_TY1) count(pro_id_TY2)

If anny issue, let me know.
Thanks
Stephane

SGF
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...