topic Re: Hi team, i need to extract the locale field in BOLD , can you help me with it in Splunk Search

Hi team, i need to extract the locale field in BOLD , can you help me with it

Hemant1 — Fri, 13 Nov 2020 06:41:35 GMT

/en_sek/klarna

paulbannister — Thu, 12 Nov 2020 14:23:32 GMT

Hi There,

If you mean via REGEX then try the following:

\.com\/(?P<locale>[^\/]+)\/

Or within the Splunk search itself:

|rex field=_raw "\.com\/(?P<locale>[^\/]+)\/"

EDIT:
Slightly improved regex to incorporate address such as ".co.uk":

((\.\w{2,3}\.\w{2,3})|\.\w{2,3})\/(?P<locale>[^\/]+)\/

or

|rex field=_raw "((\.\w{2,3}\.\w{2,3})|\.\w{2,3})\/(?P<locale>[^\/]+)\/"

paulbannister — Tue, 17 Nov 2020 15:59:43 GMT

Hi There,

\/(?P<locale>[^\/]+)\/klarna

Or within the Splunk search itself:

|rex field= ##INSERT RELEVANT FIELDNAME## "\/(?P<locale>[^\/]+)\/klarna"