topic Re: Search Query when having multiple right boundaries. in Splunk Search

Search Query when having multiple right boundaries.

xvxt006 — Fri, 21 Dec 2012 21:27:35 GMT

Hi i would like to get the commands from the below pattern. For example i am looking for search, content, gcom.suggestions.json, etc.

i have used the below query. In the rex i have mentioned to capture (at least i wanted to be) uri part which starts with / and ends with either ? (urls other than /content) or space (for /content uri there is nothing after this). But it is not working properly. Is this how this should be done? when you have multiple left and right boundaries.

sourcetype=access_combined_wcookie host=qalws* LR_VPT_HYBRIS | rex field=uri "(?i)/(?P<command>[\?|\s)" | top limit=100 command


167.115.210.254 - - [18/Dec/2012:11:29:59 -0600] "POST /search?searchQuery=RELAYS%20%20ELECTRIC* HTTP/1.1" 
167.115.210.254 - - [18/Dec/2012:11:29:59 -0600] "GET /content HTTP/1.1" 
167.115.210.254 - - [18/Dec/2012:11:29:59 -0600] "GET /content HTTP/1.1" 
167.115.210.254 - - [18/Dec/2012:11:29:59 -0600] "GET /content/homepage HTTP/1.1" 
167.115.210.254 - - [18/Dec/2012:11:29:59 -0600] "GET /gcom.suggestions.json?selectedText=TAPE%20*&start=0&count=Infinity HTTP/1.1" 
167.115.210.254 - - [18/Dec/2012:11:29:59 -0600] "POST /search?searchQuery=ADAPTER* HTTP/1.1" 
167.115.210.254 - - [18/Dec/2012:11:29:59 -0600] "GET /content/homepage HTTP/1.1" 
167.115.210.254 - - [18/Dec/2012:11:29:59 -0600] "POST /search?searchQuery=HYDRAULICS* HTTP/1.1" 
167.115.210.254 - - [18/Dec/2012:11:29:59 -0600] "POST /search?searchQuery=COPPER%20TUBING* HTTP/1.1" 
167.115.210.254 - - [18/Dec/2012:11:29:59 -0600] "GET /gcom.suggestions.json?selectedText=BEARING|*&start=0&count=Infinity HTTP/1.1"

Re: Search Query when having multiple right boundaries.

lguinn2 — Fri, 21 Dec 2012 22:32:04 GMT

sourcetype=access_combined_wcookie host=qalws* LR_VPT_HYBRIS 
| rex field=uri "/(?P<command>.*?)[?\"]"

should work

Re: Search Query when having multiple right boundaries.

xvxt006 — Fri, 21 Dec 2012 23:37:05 GMT

Thank you. I will try that.

Re: Search Query when having multiple right boundaries.

xvxt006 — Mon, 28 Sep 2020 13:00:37 GMT

Hi, I have tired and it is working but i wanted to exclude resources like js, css, img, etc.
Si have added this uri != "(?i).*.(?:js|css|png|img|png)" anything needs to be corrected in that?

sourcetype=access_combined_wcookie host=qalws* LR_VPT_HYBRIS uri != "(?i)..(?:js|css|png|img|png)" | rex field=uri "/(?P.?)[?\"]" | top limit=500 command

Re: Search Query when having multiple right boundaries.

ppuru — Tue, 19 Jun 2018 11:14:59 GMT

I have been trying to achieve this and it seems I was missing ? after .*
Your comment helped me.