Splunk Search

Specific substrings of fields (not all!) for stats to create a chart

fastdude1
New Member

Hi

I have done a fare amount of looking around and I have given up and decided to ask for help. I have extracted a field and i can easily use the search over my field for example
source="src" get_request=*foo.php*


Now I would like to know how often in the logs the get_request field contains the following:

foo.php

bar.php

fuzz.php


However i am total uninterested in every other possible value in that field.
I could do the search three different times, but i would like to half it all graphed so i can compare which of the three is say most accessed.


I have tried things like using count however it seems to be only able to do literals that match the entire field.



Any help would be appreciated.

0 Karma

Ayn
Legend

Something like this perhaps? First you create a search that will match all the events you're interested in. Then in your chart command you either split by get_request...

source=src get_request=*foo.php* OR get_request=*bar.php* OR get_request=*fuzz.php* | chart count by get_request

...or if there are a lot of different URL's that share similar filenames and you just want the stats by the filenames instead of all different URL's, split up your stats by matching on the different specific filenames you mention.

source=src get_request=*foo.php* OR get_request=*bar.php* OR get_request=*fuzz.php* | chart count(eval(match(get_request,"foo.php"))), count(eval(match(get_request,"bar.php"))), count(eval(match(get_request,"fuzz.php")))
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

First you'd write a search that only yields events with those three files matching the get_request field (wildcards + OR), second you'd pipe that into a stats count by get_request to do the report.

If you're looking for the most accessed pages in general you can use the top command in a subsearch to build the filter before doing the report.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...