Is there a free solution to count the number of context roots in an apache file?

Question

I have an apache log file. I need to report how many rows (request) are from a specific context root. The apache logs already start with a slash and context root is to the second slash.

Example Apache Log:

11.222.33.44 - - [14/Feb/2013:00:27:33 -0600] "GET /lifecontent/monitor?test=siteseer&format=siteseer HTTP/1.1" 200 275 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows NT)" "SSL=on"
111.22.333.44 - - [14/Feb/2013:00:29:29 -0600] "GET /lc/Brokerage%20Manager/IDG%20Licensing%20and%20Appointment%20Process/IDG%20Franchise%20Reference%20Manual HTTP/1.1" 302 - "-" "(Windows NT)" "SSL=-"

The two context roots would be "/lifecontent/" and "/lc"

Not sure what tool would be best? I am comfortable with GUI or batch solution.

I mostly am just trying to figure out what percentage each context root is being used within an apache files. (Ideally it could search through multiple files at once, but not a requirement.)

Answer 1

You can do this with a simple shell script:

cut -d/ -f4 access.log | sort | uniq -c | sort -g

The cut command extracts the 5th /-delimited field (i.e. the "context root"), sort | uniq -c then counts the number of occurrences of each, and sort -g orders them by number of occurrences.

Running this on my webserver gives:

   5477 misc
  11130 bzr
  32181 raspbian
  35912 files
  43020 sites

Answer 2

I accepted mgorven solution because it sent me in the right direction for a final working solution. Afetr using his solution, sometimes there are query string values and sometimes the context root does not have have an ending slash. So "/lc/" and "/lc" and "/lc?x=y" get counted as "lc". So I ending up using this solution:

cut -d" " -f7 access.log | cut -d? -f1 | cut -d/ -f2 | sort | uniq -c | sort -g

This will show individual files that got accessed and an empty line if just "/" was accessed.

Also I did this on windows using UnxUtils.zip: http://sourceforge.net/projects/unxutils. All I needed to extract was cut, sort, uniq.

Thank you mgorven!!