chart over query string

Question

Hi guys,

I have an apache log. I want to be able to chart the count of occurances of a particular query string in the uri_path.

eg.

/path/file?q1=v1&q2=v2&q3=v3
/path/file?q1=v3&q2=v1&q3=v2
/path/file?q1=v2&q2=v3&q3=v1

I want to get:

uri_path   count
q2=v1      63
q2=v2      26
q2=v3      82

I've worked out how to regex on the query string, but I can't work out how to chart count over specific q2 values of uri_path and ignore changes in q1 and q3.

Accepted Answer

0	I'd assume that you already have the q2 field extracted automatically. You can verify that it is and search: `... \| top q2` link answered 27 Oct '10, 01:58 Stephen Sorkin ♦ 8.1k●4●7 accept rate: 52% oh, hahaha I was over thinking it. Thanks, Stephen. (27 Oct '10, 02:10) chixor

chart over query string

Follow this question

Splunk Resources

Related questions