topic Re: How to trim URL after the last "/" in Splunk Search

How to trim URL after the last "/"

RaymondN80 — Sat, 27 Jul 2019 18:46:45 GMT

I'm trying to trim the URL's for a particular search, where it removes everything after the last "/".
In other words:

From:
fqdn/A/B/C/file.png
To Return:
fqdn/A/B/C

I tried using rtrim, but did not work for me.
Any help with this will be greatly appreciated!

Re: How to trim URL after the last "/"

vnravikumar — Sun, 28 Jul 2019 02:45:36 GMT

Try this rex

| makeresults 
| eval url="fqdn/A/B/C/file.png" 
| rex field=url "^(?P<test>.*[\/])" 
| eval result = replace(test,"\/$","")

Re: How to trim URL after the last "/"

HiroshiSatoh — Sun, 28 Jul 2019 02:53:17 GMT

Try this!

| makeresults |eval url="FQDN/A/B/C/file.png"
| eval object=mvindex(split(url,"/"),mvcount(split(url,"/"))-1)
| eval url=rtrim(url,"/"+object)

Re: How to trim URL after the last "/"

richgalloway — Sun, 28 Jul 2019 03:09:27 GMT

The trim function doesn't do what you think it does, although it would be nice if it did.

There are other ways to accomplish the task. The URL Toolkit app will parse the URL for you and let you choose any part(s) you like.
The rex command can do it, too.

... | rex field=url "(?<url>.*)\/"

Re: How to trim URL after the last "/"

woodcock — Sun, 28 Jul 2019 12:23:37 GMT

There are many ways to do this, including:

... | rex field=url mode=sed "s/\/[^\/]+$//"

Re: How to trim URL after the last "/"

RaymondN80 — Mon, 29 Jul 2019 20:22:23 GMT

Thanks so much! This worked!

Re: How to trim URL after the last "/"

RaymondN80 — Mon, 29 Jul 2019 20:25:00 GMT

Thanks a lot... this worked as well. Would mark it as "Accept", but I can only accept "one" answer. Appreciate it!

Re: How to trim URL after the last "/"

RaymondN80 — Mon, 29 Jul 2019 20:26:46 GMT

Thanks a lot... this worked as well. Would mark it as "Accept", but I can only accept "one" answer. Appreciate it!

Re: How to trim URL after the last "/"

RaymondN80 — Mon, 29 Jul 2019 20:27:30 GMT

Thanks a lot... this worked as well. Would mark it as "Accept", but I can only accept "one" answer. Appreciate it!

Re: How to trim URL after the last "/"

jacobpevans — Mon, 29 Jul 2019 20:28:39 GMT

Slightly simplified version:

| makeresults 
| eval url="fqdn/A/B/C/file.png" 
| rex field=url "^(?P<result>.*)/[^/]+$"

Re: How to trim URL after the last "/"

woodcock — Mon, 29 Jul 2019 21:00:24 GMT

You can UpVote as many answers or comments as you like, especially those that taught you something new and worked.