Splunk Search

Splunk newbie question

ncorchado
Explorer

Given my apache access_log URI is /Foobar/FoobarServices, I want to extract Foobar only for my timechart. makemv delim="/" allowempty=t uri returns Foobar and FoobarServices. All I want is the Foobar. How do I do that?

makemv delim="/" allowempty=t uri | timechart count by uri

Thanks!

0 Karma
1 Solution

ncorchado
Explorer

Got it
sourcetype="access_combined" | rex field=uri "^/(?.+?)/" | timechart count by JVM
Thanks!

View solution in original post

dmaislin_splunk
Splunk Employee
Splunk Employee

Cool, please accept the answer and select the up arrow then.

0 Karma

ncorchado
Explorer

Got it
sourcetype="access_combined" | rex field=uri "^/(?.+?)/" | timechart count by JVM
Thanks!

dmaislin_splunk
Splunk Employee
Splunk Employee

Did you get a new field on the left called newfield with this information?

0 Karma

ncorchado
Explorer

Yes. I tried your recommendation and I still get /Foobar/FoobarServices. I just want to capture Foobar.

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Are you just trying to extract information between the / and create a new field?

sourcetype="access_combined" | rex field=uri "^/(?.+?)/"

Something like this?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...