topic Help me with Regex in Dashboards & Visualizations

Help me with Regex

SabariRajanT — Fri, 05 Sep 2025 13:29:29 GMT

Hi Team, Am trying to write a regex function to remove the logs post / slash everything. The sample logs are here:
Sample logs:
1) ws.chatgpt.com/re/user/sdsdssdsd?verify=1757077758-CSPsqhWt%sdserere%2BJ7IesevE6CTs%3D
2)win-extension.femrerere.grammarly.io/batch/import

The / logs are not same. they are dynamic.

Expected post Regex: ws.chatgpt.com
win-extension.femetrics.grammarly.io

Can someone please help me to write a regex for the same.

Re: Help me with Regex

richgalloway — Fri, 05 Sep 2025 13:50:10 GMT

Try this SPL command

| rex mode=sed "s:([^\/]+):\1:"

To make the change at index time, put this in props.conf:

[mysourcetype] SEDCMD-postSlash = s:([^\/]+):\1:

Re: Help me with Regex

glass — Mon, 08 Sep 2025 10:54:01 GMT

Hi,
you can try this:

| makeresults format=csv data="url ws.chatgpt.com/re/user/sdsdssdsd?verify=1757077758-CSPsqhWt%sdserere%2BJ7IesevE6CTs%3D win-extension.femrerere.grammarly.io/batch/import " | rex field=url "^(?<url_short>[^\/]+)" | table url, url_short

Re: Help me with Regex

PrewinThomas — Mon, 08 Sep 2025 11:13:23 GMT

@SabariRajanT

If you don't want to create new field, use simple rex mode=sed

| makeresults | eval url="ws.chatgpt.com/re/user/sdsdssdsd?verify=1757077758" | rex field=url mode=sed "s:/.*::" | table url

If you want to create new fields like domain/url for creating any visualization/reporting use below,

| makeresults count=1 | eval raw_log="ws.chatgpt.com/re/user/sdsdssdsd?verify=1757077758-CSPsqhWt%sdserere%2BJ7IesevE6CTs%3D,win-extension.femrerere.grammarly.io/batch/import" | makemv delim="," raw_log | mvexpand raw_log | rex field=raw_log "^(?<domain>[^/]+)" | table raw_log domain

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!