Extracting a field thats not recognized

venkatachalamvi — Wed, 30 Sep 2020 05:33:00 GMT

My rawdata from log is below

METHOD="POST" URI="CALLOUT-LOG" USER_ID_DERIVED="00532000004sefcAAA" EVENT_TYPE="ApexCallout" TYPE="REST" CLIENT_IP="" URL=""https://api.contact.com/ContactAuthorizationServer/Token"" RUN_TIME="532" SESSION_KEY="" TIMESTAMP="20200529045947.928" REQUEST_SIZE="76" LOGIN_KEY="" REQUEST_ID="4WCb1_2dhf_Zn9-qbvXjs-"

Splunk assumes URL as "" since URL value is passed to index in 2 double quotes.

I used eval to parse out and get the actual URL to a field in search as URLX but the field URLX becomes jumbled if I use like stats count by URLX.

my eval is eval ..... URLX=replace(_raw, ".URL=\"\"(.)\"\" RUN_TIME.*", "\1"), "/")

How do I properly tell splunk to get URL extracted without eval in the first place.

Thanks fpr help in advance.

Re: Extracting a field thats not recognized

493669 — Fri, 29 May 2020 10:07:48 GMT

You may want to use rex to extract url-

...|rex field=URL "\"(?<URL>[^\"]+)"

Re: Extracting a field thats not recognized

venkatachalamvi — Tue, 02 Jun 2020 04:16:37 GMT

I eventually got it using this below

".*URL=\"\"(?P<urlx>.*)\"\" .*"

Thank you for the responses.

topic Extracting a field thats not recognized in Splunk Search

Extracting a field thats not recognized

Re: Extracting a field thats not recognized

Re: Extracting a field thats not recognized