Hey, i want a regex result from 10.66.189.62 -- -- -[17/May/2022:05:59:16--0400]--502- "POST /astra/sliceHTTP/1.1" req_len=1776-req_cont_len=117-req_cont_enc="-"-res_body_len=341 res_len=733 "https://ninepoint.blackrock.com/astra/ ". "Mozilla/5.0- (Macintosh; Intel-Mac-OS-X-10_15_7) -AppleWebKit/537.36-(KHTML,-Like-Gecko) Chrome/10.0.4896.127 Safari/537.36" x_fw_for="-".req_time=278.326-ups_res_time=278.326 ups_con_time=0.011-ups_status=502-pipe=. -VNDRegID=undefined- as; ninepoint Could you please help me with my query? thank you ... View more

Hi, Suppose I have these following entries in a table A-  1 A - 2 A - 3 B - 1 B-  2 I want to average the values of the same key. Something like this, A-  3.5 B - 1.5 Help me out on this  ... View more

My current Splunk regex query 10.66.189.62 -- -- -[17/May/2022:05:59:16--0400]--502- "POST /astra/sliceHTTP/1.1" req_len=1776-req_cont_len=117-req_cont_enc="-"-res_body_len=341 res_len=733 "https://ninepoint.blackrock.com/astra/". "Mozilla/5.0- (Macintosh; Intel-Mac-OS-X-10_15_7) -AppleWebKit/537.36-(KHTML,-Like-Gecko) Chrome/10.0.4896.127 Safari/537.36" x_fw_for="-".req_time=278.326-ups_res_time=278.326 ups_con_time=0.011-ups_status=502-pipe=. -VNDRegID=undefined- gives me; POST /astra/sliceHTTP/1.1   I want to apply another query on the result of above query to get  POST/astra/sliceHTTP/1.1     ,i.e /astra Is there a way or a better regex pattern which can provide me the following? ... View more