Splunk Search

Different values of parameters

xvxt006
Contributor

Hi,

I have below variations of uri patterns for a particular functionality. i want to list out query string parameters and their values separately (in a tabular format or any other format).

Say for example

For q
value count
XXX 5
YYY 3

i tried to use rex and extract fileds (q, Index, items, country, lan) but as the uri formats are in different right boundaries (for example q has right boundary & in 1st and 2nd uri pattern but i the 3rd it has no &). So how do we deal with these kind of situations?

Uri formats:

/perform?q=XXX&Index=XXX&items=XXX
/perform?q=XXX&Index=XXX&items=XXX&account=&country=XXX&lan=XXX
/perform?q=YYY
/perform?q=YYY&account=XXX
/perform?q=YYY&Index=XXX&items=XXX&account=XXX&country=XXX&lan=XXX
/perform?q=XXX&account=XXX&items=XXX
/perform?q=XXX&account=XXX&country=XXX
/perform?q=XXX&Index=XXX&items=XXX
/perform?q=XXX&account=XXX&Index=XXX&items=XXX

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

<<your base search giving field uri >>| rex field=uri "q=(?<q>.*)" | eval q="a=".q | rex field=q max_match=0 "(\w+=)+(?<value>[^&]+)" | mvexpand value | stats count by value

Update:

 <<your base search giving field uri >> | rex field=uri "q=(?<q>.*)" | eval q="q=".q | rex field=q max_match=0 "(?<key>\w+)=(?<value>[^&]+)" | eval temp=mvzip(key,value) | mvexpand temp | rex field=temp "(?<key>.*),(?<value>.*)" | stats count by key,value | stats list(count) list(value) by key

somesoni2
SplunkTrust
SplunkTrust

Try the updated answer.

0 Karma

xvxt006
Contributor

i have tried the query and it is giving me all the value but it is not separating by each key. Meaning for q these are all the values, account these are all the values, index these are all the values, etc

0 Karma

xvxt006
Contributor

Hi, if i understand it correctly, you are getting the query string into q and i did not get why you have eval q="a=".q and then you are taking that result and you are trying to separate the values using & and you have max_match=0 as it has multi value field?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...