topic Re: How do I extract a particular text from url/api endpoint using regex? in Splunk Search

How do I extract a particular text from url/api endpoint using regex?

ashinde3 — Thu, 24 Feb 2022 03:05:17 GMT

Hi all,

So, I have this URL/API endpoint as http://xml.app.com/pay/ent/auth/service/getId and I want to extract getId for the index that has field name 'end_points' and create table for the same field name that only displays the text 'getId' rather than the entire URL. How to do it using regex in Splunk. Although, I tried something like this:

rex "^http(s)?:\W+\w+\.\w+\.com\W\w+\W\w+\W\w+\W\w+\W(?<end_points>)" | table end_points

Since, I started learning Splunk quite a few days ago, I'm new to this. Any help would be appreciated. Thanks.

Re: How do I extract a particular text from url/api endpoint using regex?

m_pham — Thu, 24 Feb 2022 04:49:24 GMT

I'm not the best at regex but I think what you're going for is this:

^\S+service\/(?<end_points>[^\s]+)

Without seeing your more of the data around the URL, it's going to be hard to help you with an accurate regex.

Re: How do I extract a particular text from url/api endpoint using regex?

PickleRick — Thu, 24 Feb 2022 05:10:07 GMT

You're hugely overcomplicating this.

/(?<last_component>[^/]+/?)$

And if you already have a field called endpoints, you use it like this:

rex field=endpoints "/(?<last_component>[^/]+/?)$"