topic Re: creating field for url in Splunk Search

creating field for url

labani — Wed, 26 Jun 2013 09:45:23 GMT

How can I create a field for url? I am unable to do it by field extraction.

Re: creating field for url

MuS — Wed, 26 Jun 2013 09:47:11 GMT

like nr.5 said: need more input
please provide more detailed information about what you want to achieve and provide some example log data - thanks

Re: creating field for url

labani — Mon, 28 Sep 2020 14:10:37 GMT

2013 Jun 22 09:33:40 tracker1 httpproxy_access[41545]: 10.10.34.17 3398 TCP_MISS/200 0 NONHTTP binary://217.212.238.41:80 - DIRECT/217.212.238.41 - [acl=nonhttp] [cat=-] [err=-]
i have log like this. i want to extract url field. thank you

Re: creating field for url

MHibbin — Wed, 26 Jun 2013 11:31:31 GMT

I think the regular expression you are looking for is:

\w+\:\/\/[^\s]+

EDIT: Probably get away with using the following, however I have a habit of escaping the characters:

\w+://[^\s]+

You can test this using the rex command, like:

<yourBaseSearch> | rex field=_raw "(?P<url>\w+\:\/\/[^\s]+)" | table _time url _raw

(Don't really need the table part, just makes it easier to match it up).

Once you have your regular expression correct, you can just paste that into the IFX (Interactive Field eXtractor).

Additionally, for testing regular expressions, the following site is very helpful:

http://gskinner.com/RegExr/

Hope this helps.

Re: creating field for url

MuS — Wed, 26 Jun 2013 11:43:51 GMT

gskinner is truly one of the best online regex testing tools [^]

Re: creating field for url

MHibbin — Wed, 26 Jun 2013 12:14:09 GMT

Credit goes to @Drainy as he showed me gskinner aaaaaages ago.