Thursday, April 16, 2020

Splunk: Split URL Path by removing query parameters

If you have something like the below:

/easybiny.stockprice.json?dt=123213

and want only to get the path without query string:
/easybiny.stockprice.json

Then easy way is to do this in the Splunk search statement:

eval url=mvindex(split(request, "?"), 0) | table request,url

No comments:

Post a Comment