Splunk Search

Grouping similar results (URL)

ashwinkhai
Engager

I am trying to pull list of different URLs from a splunk query. The data is like below.

Sample data:
1. Need to group data like below as one - /v7/ap/deal/config?groupid
/v7/ap/deal/config?groupId=1234
/v7/ap/deal/config?groupId=4567
/v7/ap/deal/config?groupId=8910

  1. Need to group data like below as one - /v7/ap/deals/*/deals-allowed
    /v7/ap/deals/1234567/deals-allowed
    /v7/ap/deals/N32343Ds/deals-allowed
    /v7/ap/deals/F3e43Ds/deals-allowed

  2. Need to group datalike below as one -- /v1/deal/deals//deal-group/item?startdate

/v1/deal/deals/1234567/deal-group/item?startdate=2020-01-21
/v1/deal/deals/N1234/deal-group/item?startdate=2019-01-21
/v1/deal/deals/E2345/deal-group/item?startdate=2019-10-21
/v1/deal/deals/F2354/deal-group/item?startdate=2019-12-21

Tags (2)
0 Karma
1 Solution

codebuilder
SplunkTrust
SplunkTrust

Use the "cluster" function. It is extremely useful and will do exactly what you're asking.

Example usage:

index=_internal source=*splunkd.log* log_level!=info | cluster showcount=t | table cluster_count _raw | sort -cluster_count

alt text

----
An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

ashwinkhai
Engager

Thanks alot for the information. Is it possible to use cluster command on one field. In my case it is url field alone.

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Glad to help. And yes, you can use this with any query, just pipe the results to cluster, and/or table any fields you want to display.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

codebuilder
SplunkTrust
SplunkTrust

Use the "cluster" function. It is extremely useful and will do exactly what you're asking.

Example usage:

index=_internal source=*splunkd.log* log_level!=info | cluster showcount=t | table cluster_count _raw | sort -cluster_count

alt text

----
An upvote would be appreciated and Accept Solution if it helps!
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...