Splunk group by request url count

Question

I have a below event listed in Splunk. It logs the distinct API call made to services. Like in below example my-bag , my-basket , my-cart as distinct services and URL pattern of call is always /api/{service-name}/{v1 or v2 }/{ method name}? token = {dynamic token}. How to group by its service and get the respective count.

Group By output

Service Count
-----------
my-bag    2
my-basket 2
my-cart   1

Logs

[host=abc.com request="GET /api/my-bag/v1/add?token=8989khk768yb887" status="200" ]
[host=abc.com request="GET /api/my-basket/v1/max?token=798797hjkhjkjgh8" status="200" ]
[host=abc.com request="GET /api/my-cart/v1/add?token=78765hghjgjh" status="200" ]
[host=abc.com request="GET /api/my-bag/v1/add?token=799865mnbjhgj6" status="200" ]
[host=abc.com request="GET /api/my-basket/v1/count?token=787jkhkjhk" status="200" ]

PM 77-1 · Accepted Answer · 2022-10-07T22:47:14.860

2

Something like this:

your original search
| rex "(GET|POST|DELETE|PATCH) /api/(?<service>[\w\-]+)/"
| stats count by service

edited Oct 07 '22 at 22:47

answered Oct 07 '22 at 21:03

PM 77-1

12,933
21
68
111

It could be GET or POST or DELETE or PATCH any protocol in start of the request . How I can accommodate that – Sumeet Kumar Yadav Oct 07 '22 at 21:26
1

Updated. Just use `|` as `or`. – PM 77-1 Oct 07 '22 at 22:47
Thanks ! I have a continuation question open at https://stackoverflow.com/questions/73993208/splunk-group-by-stats-with-where-condition – Sumeet Kumar Yadav Oct 07 '22 at 23:00
1

Replied there as well – PM 77-1 Oct 07 '22 at 23:09

Splunk group by request url count

1 Answers1