https://community.splunk.com/t5/Splunk-Search/Extracting-the-end-of-a-URL/m-p/166773#M186165 <P>This works perfect. Thanks for taking the time!</P> Fri, 16 May 2014 20:06:09 GMT jravida 2014-05-16T20:06:09Z https://community.splunk.com/t5/Splunk-Search/Extracting-the-end-of-a-URL/m-p/166771#M186163 <P>Hi folks,</P> <P>I was wondering if there is a quick way to extract the end of a URL (within the URI portion) and put it in a field.</P> <P><A href="http://www.example.com/2014/05/15/world/africa/sudan-christian-woman-apostasy/index.html">www.example.com/2014/05/15/world/africa/sudan-christian-woman-apostasy/index.html</A><BR /> <A href="http://www.example.com/test/sudan-christian-woman-apostasy/test.zip">www.example.com/test/sudan-christian-woman-apostasy/test.zip</A></P> <P>So I would only want index.html and test.zip to show up in a new field.</P> <P>Hope this is easy to do, it probably is.</P> Thu, 15 May 2014 20:27:56 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-the-end-of-a-URL/m-p/166771#M186163 jravida 2014-05-15T20:27:56Z https://community.splunk.com/t5/Splunk-Search/Extracting-the-end-of-a-URL/m-p/166772#M186164 <P>Try this</P> <PRE><CODE>| rex field=fiels_name "\/(?&lt;File&gt;\\w+\\.\\w+)" </CODE></PRE> <P>Thanks</P> Thu, 15 May 2014 20:52:40 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-the-end-of-a-URL/m-p/166772#M186164 linu1988 2014-05-15T20:52:40Z https://community.splunk.com/t5/Splunk-Search/Extracting-the-end-of-a-URL/m-p/166773#M186165 <P>This works perfect. Thanks for taking the time!</P> Fri, 16 May 2014 20:06:09 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-the-end-of-a-URL/m-p/166773#M186165 jravida 2014-05-16T20:06:09Z