Splunk lookups also support wildcards, which we can use in this case.
One advantage is that we can define arbitrary fields for grouping, independent of the values of url.
For a lookup wildcard to work, first we need to set up our url field and the lookup:
- Extract the url field. The rex pattern we used before should work:
s[AZ]+s(?P<url>.*?)s. See Chapter 5, Tables, Charts, and Fields, for detailed instructions on setting up a field extraction. Don't forget to set permissions on the extraction.
- Create our lookup file. Let's call the lookup file flatten_summary_lookup.csv. Use the following contents for our example log:
url,section /about/*,about /contact/*,contact /*/*,unknown_non_root /*,root *,nomatch