topic Re: Another regex in Splunk Search

Another regex

dbcase — Tue, 29 Sep 2020 16:02:41 GMT

Hi,

I have this data

10.210.192.15 - - [26/Sep/2017:19:59:59 -0400] "POST /rest/icontrol/sites/315568/network/instances/100876ffe9572a.0/functions/disarm HTTP/1.1" 202 9 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "

10.210.192.5 - - [26/Sep/2017:19:59:59 -0400] "POST /rest/icontrol/sites/4793/network/instances/140024460000052928.10.0/functions/thermostatStatus HTTP/1.1" 202 9 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-" "-"

6:59:59.000 PM

10.210.192.15 - - [26/Sep/2017:19:59:59 -0400] "GET /rest/icontrol/sites/4793/network/lights/getAllLightingStatus HTTP/1.1" 202 9 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-" "-"

And I think I need to do a backwards match (unless there is a better way). I need to match

disarm in the first event
thermostatStatus in the second event
getAllLightingStatus in the third event

I'm ok with regex but trying to wrap my mind around how to search backwards throws me for a loop!

Re: Another regex

DalJeanis — Wed, 27 Sep 2017 23:49:16 GMT

Nothing backwards about it. We want a chunk that occurs between a slash "/" and the letters " HTTP". We want to make sure not to match the space \s or any other slashes \/.

Thus, we create a character type that matches anything but slash or whitespace [^\/\s], and capture however many of them there are, (but minimum one +) between our endpoints.

   | rex "\/(?<mymatch>[^\/\s]+)\sHTTP"

Voila.

Re: Another regex

dbcase — Thu, 28 Sep 2017 15:22:22 GMT

wow, that is pretty slick

Re: Another regex

DalJeanis — Thu, 28 Sep 2017 16:27:16 GMT

@dbcase - It's all in learning how to look at it. Sometimes you just have to take three steps back. Sometimes you have to cross your eyes. Sometimes you have to get out a chainsaw and cut a wall out of the way. 😉

Re: Another regex

dbcase — Thu, 28 Sep 2017 23:01:39 GMT

I can't wait to use the chainsaw! 🙂