If you have something like the below:
/easybiny.stockprice.json?dt=123213
and want only to get the path without query string:
/easybiny.stockprice.json
Then easy way is to do this in the Splunk search statement:
eval url=mvindex(split(request, "?"), 0) | table request,url
No comments:
Post a Comment