How do I remove specific parameters from URL in splunk?

donet prof 0
Viewed 21

/app/account-headless#state=FD=reqdoc&PN=952949&accessMode=Internet&accessType=MOBILE

In splunk, I would like to group by the URLs by filtering/removing the parameter based on parameter name, for example remove PN=952949 or accessType=MOBILE

splunk-query splunk
2 Answers

Try using sed to remove the undesired parameters. You'll need one sed command for each parameter.

| rex mode=sed field=URL "s/[?&]PN=[^&$]+//"
| rex mode=sed field=URL "s/[?&]accessType=[^&$]+//"
RichG0

@RichG suggested rex in sed mode

You can also use a pair of eval replace calls:

| eval URL=replace(URL,"\&PN=[^\&]+","")
| eval URL=replace(URL,"\&accessType=[^\&]+","")
userSa10
Related