topic Re: Regex help in Splunk Search

Regex help

JPaule — Wed, 30 Sep 2020 00:28:52 GMT

Could someone help me on this regex? I only want the first part of the data up to "AWSLogs". Example Below:

s3://this-is-bucket-name/test/AWSLogs/123457276024/Config/us-gov-west-1/2019/5/6/ConfigHistory/123457276024_Config_us-gov-west-1_ConfigHistory_AWS::EC2::VPC_20190506T182522Z_20190506T182912Z_1.json.gz

I only need:
s3://this-is-bucket-name/test/AWSLogs

Re: Regex help

MuS — Thu, 09 May 2019 19:40:42 GMT

Hi JPaule,

give this a try:

| makeresults 
| eval foo="s3://this-is-bucket-name/test/AWSLogs/123457276024/Config/us-gov-west-1/2019/5/6/ConfigHistory/123457276024_Config_us-gov-west-1_ConfigHistory_AWS::EC2::VPC_20190506T182522Z_20190506T182912Z_1.json.gz" 
| rex field=foo "(?<s3BucketName>^s3:\/\/[^\/]+\/[^\/]+\/AWSLogs\/)"

Hope this helps ...

cheers, MuS

Re: Regex help

koshyk — Thu, 09 May 2019 19:43:38 GMT

Please find sample

|makeresults
|eval myraw="s3://this-is-bucket-name/test/AWSLogs/123457276024/Config/us-gov-west-1/2019/5/6/ConfigHistory/123457276024_Config_us-gov-west-1_ConfigHistory_AWS::EC2::VPC_20190506T182522Z_20190506T182912Z_1.json.gz"
| rex field=myraw "(?<aws_regex>s3:\/\/.+?\/.+?\/.+?\/)"
| table myraw,aws_regex

demo in regex101 => https://regex101.com/r/KkQkfR/1