topic Re: help with regex in Splunk Search

help with regex

vrmandadi — Wed, 31 Jan 2018 21:00:33 GMT

I have the below sample data, and I want to extract everything after the service URL till maxd=60&mind=60 into a new field called service.

I have used (?i) url: (?P.+?)\w+= but it is not extracting completly

31 Jan 2018 20:22:13 [INFO ] AD Transaction: timestamp: 1513204259, transactionID: 2899739, reqID: 3022368026, uuid: 72dca744-b342-4aac-9861-005056b21335, type: ad request, transaction: start, service url: http://mrm.mdc.time.com/ad/p/1?nw=376521&mode=live&vdur=600&flag=+sltp+amsl+ssus+amcb+dtrd&metr=1031&prof=376521:twc_hls_live&caid=SCI_LIVE&csid=stva_ios_tab_live&resp=vmap1&pvrn=72dca744-b342-4aac-9861-005056b21335&vprn=72dca744-b342-4aac-9861-005056b21335&vcid=ff5cac5c-8dfe-31c5-a497-8bf8be88095a&vcid2=ff5cac5c-8dfe-31c5-a497-8bf8be88095a&vip=24.211.233.182;;&ptgt=a&slau=midroll&slid=3545782&cpsq=1513204259&maxd=60&mind=60, client url: http://mmdai-linear-west-01.time.com

Re: help with regex

gokadroid — Wed, 31 Jan 2018 21:13:30 GMT

How about trying this:

your query to return events
| rex "service url:\s*(?<service>.*)&maxd=60&mind=60"
| table service

see extraction here

Re: help with regex

493669 — Thu, 01 Feb 2018 02:22:16 GMT

try this also:

...| rex "(?i)service url:\s*(?<service>.*)&maxd=60&mind=60"

Re: help with regex

mayurr98 — Thu, 01 Feb 2018 06:24:08 GMT

hey try this run anywhere search

| makeresults 
| eval _raw="31 Jan 2018 20:22:13 [INFO ] AD Transaction: timestamp: 1513204259, transactionID: 2899739, reqID: 3022368026, uuid: 72dca744-b342-4aac-9861-005056b21335, type: ad request, transaction: start, service url: http://mrm.mdc.time.com/ad/p/1?nw=376521&mode=live&vdur=600&flag=+sltp+amsl+ssus+amcb+dtrd&metr=1031&prof=376521:twc_hls_live&caid=SCI_LIVE&csid=stva_ios_tab_live&resp=vmap1&pvrn=72dca744-b342-4aac-9861-005056b21335&vprn=72dca744-b342-4aac-9861-005056b21335&vcid=ff5cac5c-8dfe-31c5-a497-8bf8be88095a&vcid2=ff5cac5c-8dfe-31c5-a497-8bf8be88095a&vip=24.211.233.182;;&ptgt=a&slau=midroll&slid=3545782&cpsq=1513204259&maxd=60&mind=60, client url: http://mmdai-linear-west-01.time.com"; 
| rex field=_raw "service\surl\:\s+(?<service_URL>.*)&maxd=60&mind=60"

In your environment, you should write

<base_search> | rex field=_raw "service\surl\:\s+(?<service_URL>.*)&maxd=60&mind=60"

let me know if this helps!

Re: help with regex

vrmandadi — Thu, 01 Feb 2018 16:43:59 GMT

This helped,made some changes to it..Thanks