topic How to extract data at specific position from url? in Splunk Search

How to extract data at specific position from url?

marcosjags — Mon, 25 Apr 2022 15:17:28 GMT

Hello Everyone,

I am new to splunk. I am searching the logs and I am getting my url like this /api/sns/exts/djs/310200019110274535/ds/310200019110274536/. What I want here is i want to extract the djs data which is 310200019110274535 in this case. Any help would be appreciated.

Re: extract data at specific position from url

gcusello — Mon, 25 Apr 2022 07:14:48 GMT

Hi @marcosjags,

if the string to extract is always in the seventh position in the url, you can use something lie this:

| rex "^(\/\w+){6}\/(?<djs>\d+)"

that you can test at https://regex101.com/r/HvJFCS/1

if instead after the string to extract there's always "/.", you can use this regex

| rex "(?<djs>\d+)\/\."

Ciao.

Giuseppe

Re: extract data at specific position from url

ITWhisperer — Mon, 25 Apr 2022 07:20:27 GMT

Or if it always follows "/djs/"

| rex "\/djs\/(?<djs>\d+)\/"

The main thing is that you need to determine the pattern in the URL which helps you anchor where to find the data you are looking for.

Re: extract data at specific position from url

marcosjags — Mon, 25 Apr 2022 07:24:58 GMT

@gcusello How can i show that in the table next to url like this

/api/sns/exts/djs/310200019110274535/ds/310200019110274536/ 310200019110274535

do I have to hold this in a variable and then should I do

table url variable

Re: extract data at specific position from url

gcusello — Mon, 25 Apr 2022 07:28:45 GMT

Hi @marcosjags,

you should try something like this:

index=your_index | rex field=url "^(\/\w+){6}\/(?<variable>\d+)" | table url variable

If you need also to extract url field, you should share some sample of your logs.

My hint is to follow the Splunk Search Tutorial (https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial/WelcometotheSearchTutorial) to know how to use Splunk commands.

Ciao.

Giuseppe

Re: extract data at specific position from url

marcosjags — Mon, 25 Apr 2022 07:34:56 GMT

Thanks for the help @gcusello . I will surely check the documentation

Re: extract data at specific position from url

gcusello — Mon, 25 Apr 2022 07:35:10 GMT

Hi @marcosjags,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉