topic Re: regex not working propoerly in Splunk Search

regex not working propoerly

prannoy93singh — Tue, 03 Jul 2018 22:09:14 GMT

/api/v1/user/engines/forecast/xyz?abc=true

For the above URL, I want to display the URL in the table till xyz (/api/v1/user/engines/forecast/xyz).
I am using the following regex

| regex requestURI = _raw "/[^?]*/"                                // not include data after ?
| regex requestURI = ".*[^.txt]$"                                     // no .txt extensions in the URI
| regex requestURI = "/[0-9a-zA-Z]{3,}/"                         // minimum length should be 3

But the first one is not working and the whole URL is being displayed

Re: regex not working propoerly

MuS — Tue, 03 Jul 2018 22:13:49 GMT

Hi prannoy93singh,

to match / you need to escape them in the regex, try this:

 \/[^?]+

cheers, MuS

Re: regex not working propoerly

prannoy93singh — Tue, 03 Jul 2018 22:43:25 GMT

I tried running the above query, but it is still not giving the desired result.

/api/v1/user/abc/xyz/24966700::2?personalizationChannel=ADVISOR_CENTER

such queries are still showing

Re: regex not working propoerly

MuS — Wed, 04 Jul 2018 00:36:20 GMT

Use rex instead, test it with this run everywhere example:

| makeresults 
| eval foo="/api/v1/user/abc/xyz/24966700::2?personalizationChannel=ADVISOR_CENTER" 
| rex field=foo "(?<MyNewField>\/[^?]+)"

the field MyNewField has the value of /api/v1/user/abc/xyz/24966700::2 in this example.

cheers, MuS

Re: regex not working propoerly

woodcock — Wed, 04 Jul 2018 01:35:05 GMT

You are confusing regex with rex. Try this:

|makeresults | eval _raw="/api/v1/user/engines/forecast/xyz?abc=true"
| rex "^(?<requestURI1>/[^?]*/)"
| rex "(?<requestURI2>.*[^.txt])$"
| rex "(?<requestURI3>/[0-9a-zA-Z]{3,}/)"