Splunk Search

In a search, how do you group similar URL patterns?

alex129
New Member

I am doing a search and evaluating count, avg RT based on some URL patterns. Below are the URLs for my category pages :

//Food/Back-to-School/Breakfast/Breakfast-Bars/c/1015001004
//Food/Back-to-School/Breakfast/Cereal/c/1015001001
//Home-%26-Lifestyle/Beauty/Cosmetics/Eyes/c/2004001001

Using below query gives me the different results for different URLs, but I want results grouped into 1 Relative URL.

sourcetype=apache:access request_uri="\*/c/\*"  |  search apache_responsetime=* | chart perc90(apache_responsetime) over request_uri

What query I should use to get desired results?

0 Karma

burwell
SplunkTrust
SplunkTrust

So I recommend creating a new field which normalizes the request uris. Also you don't need a separate search apache_responsetime=*. Just combine it. The default is to AND the searches.

It is not clear what the space of your URLs is. If you want to lump all Food and all Home life style pages together then maybe something like:

 sourcetype=apache:access request_uri="\*/c/\*"  apache_responsetime=* | rex field=request_uri "//(?<category>\S+)/" | chart perc90(apache_responsetime) by category
0 Karma

alex129
New Member

@burwell

Your query is grouping all URLs post '/c/' i.e.

/Food/Back-to-School/Breakfast/Breakfast-Bars/c/1015001001
/Food/Back-to-School/Breakfast/Breakfast-Bars/c/1015001002
/Food/Back-to-School/Breakfast/Breakfast-Bars/c/1015001003

into 

/Food/Back-to-School/Breakfast/Breakfast-Bars/c/

I need all URLs before /c/ as well to group into 1 URL

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Since you're looking at only specific type of URIs (only one pattern), you can simply do something like this

sourcetype=apache:access request_uri="\*/c/\*"  apache_responsetime=* 
| stats perc90(apache_responsetime)  | eval request_uri="*/c/*" | table requiest_uri perc90(apache_responsetime)

A more generic approach would be this (where you can look for multiple URI patterns)

sourcetype=apache:access (request_uri="\*/a/\*" OR   request_uri="\*/b/\*" OR...other patterns ) apache_responsetime=* 
| eval request_uri=case(searchmatch(request_uri="\*/a/\*"),"*/a/*", request_uri="\*/b/\*"),"*/b/*",..literal/static values for other patterns..)
| chart perc90(apache_responsetime) over request_uri
0 Karma

alex129
New Member

@somesoni2 ,

Your 1st query, I am getting the results for 90th percentile in 1 column, But
1. Not getting chart over time for grouped URL
2. how to get stats count for all these URLs

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@alex129, Can you explain with example what do you mean by similar url?

0 Karma

alex129
New Member

@VatsalJagani , the URLs mentioned in my questions are for category page & can be searched as requesturi="/c/"

0 Karma

burwell
SplunkTrust
SplunkTrust

So if they have /c/ they are the same? What are other url patterns?

0 Karma

alex129
New Member

@burwell
I mean "/c/" is common in all category URLs and I need to group all these URLs so that I can get count, response time etc. for grouped URL

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...