Another regex

dbcase — Tue, 03 Oct 2017 17:11:27 GMT

Hi,

I have this data

10.210.192.15 - - [02/Oct/2017:19:59:59 -0400] "GET /rest/icontrol/sites/278318/eventsByDay?startDate=2017-10-01&endDate=2017-10-01&maxResults=65536 HTTP/1.1" 200 16242 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-"  "-"


10.210.192.15 - - [02/Oct/2017:19:59:59 -0400] "GET /rest/icontrol/sites/304496/templates/triggerTemplates HTTP/1.1" 401 6 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-"  "-"

I need to get "eventsByDay" from the first line and "TriggerTemplates" from the second line

I've tried this regex

rex "\/(?[^\/\s]+)\sHTTP" (this one works for the second one just fine)
rex "\/(?[^\/\s]+)\?" (this one works for the first line just fine)

I'm running into trouble on how to combine the 2 regex into one. Any thoughts?

Re: Another regex

dbcase — Tue, 03 Oct 2017 17:27:22 GMT

Tried this one too..... close but still not quite it

\/(?<function>[^\/\s]+)(\?|\sHTTP)

Re: Another regex

chanfoli — Tue, 03 Oct 2017 18:33:11 GMT

This appears to work with your 2 examples:

\/(?<function>\w*)(\s|\?)

Re: Another regex

dbcase — Tue, 03 Oct 2017 19:03:27 GMT

Hi Chanfoli,

Wow, many thanks! Worked like a champ!

topic Re: Another regex in Splunk Search

Another regex

Re: Another regex

Re: Another regex

Re: Another regex