https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-come-up-with-a-regex-for-an-API-path/m-p/427128#M122319 <P>Hi Community,</P> <P>Sorry this should be easiest for you, but i have many problem with regex ....</P> <P>i want to keep the first 3 sets of information (bellow in red)</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5924iF959AB9397F555A4/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>i have already done this :</P> <BLOCKQUOTE> <P>" |rex field=uri_path "^/(?\w+)" | </P> </BLOCKQUOTE> <P>but i have only the first.</P> <P>Can you help me ?</P> Tue, 16 Oct 2018 11:41:18 GMT serviceinfrastr 2018-10-16T11:41:18Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-come-up-with-a-regex-for-an-API-path/m-p/427128#M122319 <P>Hi Community,</P> <P>Sorry this should be easiest for you, but i have many problem with regex ....</P> <P>i want to keep the first 3 sets of information (bellow in red)</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5924iF959AB9397F555A4/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>i have already done this :</P> <BLOCKQUOTE> <P>" |rex field=uri_path "^/(?\w+)" | </P> </BLOCKQUOTE> <P>but i have only the first.</P> <P>Can you help me ?</P> Tue, 16 Oct 2018 11:41:18 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-come-up-with-a-regex-for-an-API-path/m-p/427128#M122319 serviceinfrastr 2018-10-16T11:41:18Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-come-up-with-a-regex-for-an-API-path/m-p/427129#M122320 <P>Hi,</P> <P>You can use below regular expression to extract those values</P> <PRE><CODE>&lt;yourBaseSearch&gt; | rex field=uri_path "^(?&lt;extracted_uri&gt;\/\w+\/\w+\/\w+\/?)" </CODE></PRE> Tue, 16 Oct 2018 12:10:27 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-come-up-with-a-regex-for-an-API-path/m-p/427129#M122320 harsmarvania57 2018-10-16T12:10:27Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-come-up-with-a-regex-for-an-API-path/m-p/427130#M122321 <P>this should work:</P> <PRE><CODE> | rex field=uri_path "^(?&lt;myfield&gt;/\w+/\w+/\w+/)" </CODE></PRE> Tue, 16 Oct 2018 12:13:31 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-come-up-with-a-regex-for-an-API-path/m-p/427130#M122321 jlelli 2018-10-16T12:13:31Z