topic Regex string end of the url and in between in Splunk Search

Regex string end of the url and in between

panandshah — Tue, 29 Sep 2020 19:34:45 GMT

10.1.151.100 [18/May/2018:09:09:57 +0200] "GET http://example.com/DCQ/templates/GetAggregated?channel=TV&contentId=4ek4k4&lang=eng HTTP/1.1" 200 2856 hit 0.000111 hit - 154.176.135.239
10.1.51.16 [18/May/2018:09:20:42 +0200] "GET http://video-play.vodacom.co.za/AVS/besc?action=GetIsFavorite&channel=IPHONE&contentId=1200668 HTTP/1.1" 200 113 miss 0.007757 miss - 19.392.33.103
10.1.51.16 [18/May/2018:08:37:51 +0200] "GET http://example.com/AVS/besc?username=00007&channel=ANDROID&action=GetAccountList HTTP/1.1" 200 1516 miss 0.030941 miss - 203.122.32.11

I tried this but it does not print the ones with action=<> that are at the end of the url.
index=index-name_idx earliest=-1h | rex "(?i)action=(?P[^&]+)" |stats count by test
index=index-name_idx earliest=-1h | rex "(?i)action=(?P[^&]+|[\s]+)" |stats count by test

The result i get is:
CheckSession 444
DeleteFavourite 1
GetAccountList 116
GetAccountList HTTP/1.1" 200 1516 miss 0.030941 miss - 119.92.253.103 1
GetAccountList HTTP/1.1" 200 1898 miss 0.029884 miss - 119.92.253.103 1
GetAccountList HTTP/1.1" 200 1902 miss 0.023020 miss - 119.92.253.103 1

I want result for action=<> anything sorted by channel= and count but the key action could be anywhere in the URL and hence i dont get the exact count.

How do we use regex to find action=<> if it is at the end of the URL.

Re: Regex string end of the url and in between

niketn — Fri, 18 May 2018 09:02:57 GMT

@panandshah, please use the Code button ie. button with 101010 or shortcut key CTRL+K while posting data or code so that special characters do not escape.

Based on the data sample provided, can you try the following regex?

  index=index-name_idx earliest=-1h | 
 | rex  "action=(?<action>[^\&\s]+)[&|\s]"

What is the action field in the first example is there a pattern for that?
Also the third data has channel=ANDROID∾tion=GetAccountList is the ∾ character actually present in your raw data or is it due to copy paste and the character is actually ac.?
Do you need to extract channel as well?

Re: Regex string end of the url and in between

panandshah — Fri, 18 May 2018 14:58:47 GMT

That works indeed!! Thanks