https://community.splunk.com/t5/Splunk-Dev/Tricky-regex/m-p/367734#M5990 <P>If you post the regex that correctly gets the number, then this would be easier to be completely right. You are going to add this on the end of that regex, inside your quotes... </P> <PRE><CODE>\/(?&lt;function&gt;[^?\d\/]+) </CODE></PRE> <P>The above translates as, match one slash, and then take at least one character made up of anything that is not a question mark, whitespace, or a slash and put it into the variable called <CODE>function</CODE>.</P> <P>I believe the whole thing will look like this...</P> <PRE><CODE>| rex "\/rest\/icontrol\/sites\/(?&lt;number&gt;\d+)\/(?&lt;function&gt;[^?\d\/]+)" </CODE></PRE> Wed, 27 Sep 2017 18:16:43 GMT DalJeanis 2017-09-27T18:16:43Z https://community.splunk.com/t5/Splunk-Dev/Tricky-regex/m-p/367733#M5989 <P>Hi,</P> <P>I have this data</P> <PRE><CODE>10.210.192.5 - - [26/Sep/2017:19:59:59 -0400] "POST /rest/icontrol/sites/266646/decreaseWatchCount HTTP/1.1" 200 - "-" "Mozilla/5.0 (Linux; Android 7.1.1; XT1635-01 Build/NDNS26.118-23-1; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/61.0.3163.98 Mobile Safari/537.36" "-" "-" 10.210.192.15 - - [26/Sep/2017:19:59:59 -0400] "GET /rest/icontrol/sites/236039/eventsByDay?startDate=2017-09-25&amp;endDate=2017-09-25&amp;maxResults=65536 HTTP/1.1" 200 68785 "https://portal.coxhomelife.com/sp/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36" "-" "-" 10.210.192.5 - - [26/Sep/2017:19:59:59 -0400] "GET /rest/icontrol/sites/267452/fetchImage?imageId=5222117165&amp;imageType=image HTTP/1.1" 200 187081 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-" "-" 10.210.192.15 - - [26/Sep/2017:19:59:59 -0400] "POST /rest/icontrol/sites/315568/network/instances/100876ffe9572a.0/functions/disarm HTTP/1.1" 202 9 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-" "-" </CODE></PRE> <P>I need to be able to get the number (266646, 236039, 267452 already have regex for this) and the function. The function is the tricky one. Based on this data the functions would be:</P> <P>decreaseWatchCount<BR /> eventsByDay<BR /> fetchImage<BR /> network</P> <P>I've tried everything I can think of but I can't seem to find a way to be successful on all the different function formats.</P> Wed, 27 Sep 2017 17:24:51 GMT https://community.splunk.com/t5/Splunk-Dev/Tricky-regex/m-p/367733#M5989 dbcase 2017-09-27T17:24:51Z https://community.splunk.com/t5/Splunk-Dev/Tricky-regex/m-p/367734#M5990 <P>If you post the regex that correctly gets the number, then this would be easier to be completely right. You are going to add this on the end of that regex, inside your quotes... </P> <PRE><CODE>\/(?&lt;function&gt;[^?\d\/]+) </CODE></PRE> <P>The above translates as, match one slash, and then take at least one character made up of anything that is not a question mark, whitespace, or a slash and put it into the variable called <CODE>function</CODE>.</P> <P>I believe the whole thing will look like this...</P> <PRE><CODE>| rex "\/rest\/icontrol\/sites\/(?&lt;number&gt;\d+)\/(?&lt;function&gt;[^?\d\/]+)" </CODE></PRE> Wed, 27 Sep 2017 18:16:43 GMT https://community.splunk.com/t5/Splunk-Dev/Tricky-regex/m-p/367734#M5990 DalJeanis 2017-09-27T18:16:43Z https://community.splunk.com/t5/Splunk-Dev/Tricky-regex/m-p/367735#M5991 <P>Hi DalJeanis,</P> <P>THANK YOU!!! That worked perfectly!</P> Wed, 27 Sep 2017 18:33:51 GMT https://community.splunk.com/t5/Splunk-Dev/Tricky-regex/m-p/367735#M5991 dbcase 2017-09-27T18:33:51Z