topic Re: Help in Regex in Splunk Search

Help in Regex

aditsss — Fri, 21 Aug 2020 17:53:45 GMT

Hi Team,

I have one requirement :

I have multiple URL'S some contain id and some dont contain id's

URL'S Example

https://opu/api/processs/3fe13d52-d326-15a1-acef-ed3395edd973/registry(with ID)

https://POI/api/processors/022adcc6-8001-3d7a-b291-3d0831458357(with ID)

https://uyt/api/flow/config (WITHOUT ID)

Like this there are more multiple URL's

MY id pattern is this in URL's: 05ee3b30-d5e1-1977-9aa9-61c458568edb

So I have made regex like this:

^.*([A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})$

Can someone help me out with complete regex . How can I put this (^.*([A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})$) in one column which only contain id's using regex.

Re: Help in Regex

richgalloway — Fri, 21 Aug 2020 18:04:23 GMT

If I understand the question correctly then this search should extract the ID from those URLs that have them.

index=foo URL* | rex field=URL "(?<ID>[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})"

Re: Help in Regex

aditsss — Fri, 21 Aug 2020 18:58:34 GMT

Hi,

I am able to get one new column ID which contains the ID from Request_URL

But not able to get the records which does not include ID like

https://abc/api/flow/prioritizers

https://poi/api/flow/controller-service-types

https://liu/api/flow/groups/root

I want these records should also be display and ID column should be blank for them.

Can someone guide me.

Re: Help in Regex

aditsss — Sat, 22 Aug 2020 20:34:16 GMT

Hi, I am able to get one new column ID which contains the ID from Request_URL But not able to get the records which does not include ID like

https://abc/api/flow/prioritizers

https://poi/api/flow/controller-service-types

https://liu/api/flow/groups/root

I want these records should also be display and ID column should be blank for them.

Can someone guide me.

Its really required.

Thanks in advance

Re: Help in Regex

ITWhisperer — Sun, 23 Aug 2020 09:04:10 GMT

Already answered here https://community.splunk.com/t5/Splunk-Search/How-to-extract-portion-of-the-string-using-Regex/td-p/514351/jump-to/first-unread-message

Re: Help in Regex

aditsss — Tue, 25 Aug 2020 18:34:14 GMT

Thank u so much ITWhisperer for all your guidance.