Splunk group by request url count-CodePudding

I have a below event listed in Splunk. It logs the distinct API call made to services. Like in below example my-bag , my-basket , my-cart as distinct services and URL pattern of call is always /api/{service-name}/{v1 or v2 }/{ method name}? token = {dynamic token}. How to group by its service and get the respective count.

Group By output

Service Count
-----------
my-bag    2
my-basket 2
my-cart   1

Logs

[host=abc.com request="GET /api/my-bag/v1/add?token=8989khk768yb887" status="200" ]
[host=abc.com request="GET /api/my-basket/v1/max?token=798797hjkhjkjgh8" status="200" ]
[host=abc.com request="GET /api/my-cart/v1/add?token=78765hghjgjh" status="200" ]
[host=abc.com request="GET /api/my-bag/v1/add?token=799865mnbjhgj6" status="200" ]
[host=abc.com request="GET /api/my-basket/v1/count?token=787jkhkjhk" status="200" ]

CodePudding user response：

Something like this:

your original search
| rex "(GET|POST|DELETE|PATCH) /api/(?<service>[\w\-] )/"
| stats count by service