Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to grab the directory paths of GET requests and count them in Splunk using this capturing regex.

index=main sourcetype="access_combined_wcookie" | rex "(?i)\"GET /(?P<MYDIR>\w+)/" | timechart count by MYDIR 

This sort of works. It grabs the name of the top level directories and sums them up by time as expected, except that it also displays HEAD requests as "NULL" or "OTHER."

The regex works as expected in both perl and Python (ie, it doesn't match on a HEAD request.) Anyone have an idea what I have to do to make Splunk stop reporting the stuff that I didn't capture to begin with? This behavior is really counter-intuitive.

share|improve this question
Why not use field extractions (and filters on them)? – Shane Madden Jul 14 '13 at 1:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.