topic Re: Help to extract fields from the URL in Splunk Search

Help to extract fields from the URL

maria_n — Thu, 05 Dec 2019 10:41:50 GMT

I need to extract "internal-blue-ocf" as namespace and "stress-b.aps.gc1-b.lle.ocf.xxx.com" as service using rex from the below data.
The condition for the fields should be like,
1) namespace: content between http:// and -oic
2) service: content should start after oic- and ends at .com

MESSAGE: 2019-12-05 04:04:42, Environment=OIC STRESS B, Service=, Status=000, Response_Time=0.000, Endpoint=http://internal-blue-ocf-oic-stress-b.aps.gc1-b.lle.ocf.xxx.com/oic/

The rex should be used on field called MESSAGE. Please help!

Re: Help to extract fields from the URL

vnravikumar — Thu, 05 Dec 2019 10:51:14 GMT

Try this

| makeresults 
| eval MESSAGE="MESSAGE: 2019-12-05 04:04:42, Environment=OIC STRESS B, Service=, Status=000, Response_Time=0.000, Endpoint=http://internal-blue-ocf-oic-stress-b.aps.gc1-b.lle.ocf.xxx.com/oic/" 
| rex field=MESSAGE "Endpoint=http:\/\/(?P<namespace>.+)-oic-(?P<service>.+.com)"

Re: Help to extract fields from the URL

kamlesh_vaghela — Thu, 05 Dec 2019 10:51:53 GMT

@maria_n

Can you please try this?

YOUR_SEARCH | rex field=MESSAGE " Endpoint=http:\/\/(?<namespace>.*)-oic-(?<service>.*\.com)" 
| table namespace service MESSAGE

Sample:

| makeresults 
| eval MESSAGE="MESSAGE: 2019-12-05 04:04:42, Environment=OIC STRESS B, Service=, Status=000, Response_Time=0.000, Endpoint=http://internal-blue-ocf-oic-stress-b.aps.gc1-b.lle.ocf.xxx.com/oic/" 
| rex field=MESSAGE " Endpoint=http:\/\/(?<namespace>.*)-oic-(?<service>.*\.com)" 
| table namespace service MESSAGE

Thanks

Re: Help to extract fields from the URL

kartm2020 — Thu, 05 Dec 2019 11:19:58 GMT

Please try the below
| rex field=_raw "http:..(?P\w+-\w+-\w+)-oic-(?P.*.com)"

If the data look likes above, this regex will work. But the data contains numbers in between word. We need to write different regex.
Kindly let me know if it works.

Re: Help to extract fields from the URL

maria_n — Thu, 05 Dec 2019 11:25:26 GMT

Thanks @vnravikumar and @kamlesh_vaghela. It worked 🙂

Re: Help to extract fields from the URL

maria_n — Thu, 05 Dec 2019 11:28:21 GMT

Sorry, this didn't work @kartm. The above ones shared by kamlesh and ravikumar worked for me. Thanks anyway 🙂