Hi,
I have a Splunk search which gives list of URLs and their corresponding response times like:
/webapp/store/p/product1, 1
/webapp/store/p/product2, 2
/webapp/store/p/product3, 1
/webapp/store/l/list1, 1.12
/webapp/store/l/list2, 0.12
/webapp/store/home, 1.12
/webapp/store/page4, 1.12
/webapp/store/page5, 1.12
Now, I want to do a pattern search on these urls and want to add the response times of similar patterned urls.
Desired output:
/webapp/store/p/, 4
/webapp/store/l/, 1.24
/webapp/store/home, 1.12
/webapp/store/page4, 1.12
/webapp/store/page5, 1.12
Any help would be appreciated.
Thanks
This should get you started:
... | rex field=URL "(<?PbaseURL>\/\w+\/\w+\/\w+)" | stats sum(time) as totalTime by baseURL | table baseURL totalTime
Try this:
base search | rex field=url "^(?<pattern>/[^/]+/[^/]+/[^/]+/?)" | stats sum(response_time) by pattern