topic Re: How to do a regex for break an url after the fourth slash? in Splunk Search

How to do a regex for break an url after the fourth slash?

jip31 — Mon, 16 May 2022 17:00:03 GMT

hello

I try to do a regex for break an url after the fourth slash

https://xxxx/yyyy/test

could you help please?

Re: Help on regex for breaking an url

richgalloway — Mon, 16 May 2022 16:36:40 GMT

It would have helped to know what you'd tried before so we wouldn't suggest the same expressions.

Have you tried (?<field1>(?:.*?\/){4})(?<field2>.*) ?

Re: How to do a regex for break an url after the fourth slash?

etoombs — Mon, 16 May 2022 19:40:54 GMT

Depending on what you need, there may be other ways to accomplish this. Are you just trying to capture the final value, or would it always be after the 4th / even if there were more after it?

Re: Help on regex for breaking an url

jip31 — Tue, 17 May 2022 06:20:49 GMT

thanks it works but I would like to do the break in the same line, actually it's done on 2 lines

is it possible?

Re: Help on regex for breaking an url

ITWhisperer — Tue, 17 May 2022 06:28:55 GMT

Please explain what you mean by this, perhaps with some sample events and what your desired output would be?

Re: How to do a regex for break an url after the fourth slash?

gcusello — Tue, 17 May 2022 06:37:12 GMT

Hi @jip31,

please try something like this:

your_search | rex "^(https|http):(?<url>\/\/\w+\/\w+\/)"

that you can test at https://regex101.com/r/4kTIF3/1

Ciao.

Giuseppe

Re: How to do a regex for break an url after the fourth slash?

jip31 — Tue, 17 May 2022 07:27:44 GMT

It's not my need

My need is dont to match the fourfth / but to break the URL after the fourfth / into a single line

Re: How to do a regex for break an url after the fourth slash?

gcusello — Tue, 17 May 2022 07:31:30 GMT

Hi @jip31,

my regex puts in the url field the url until the fourth slash, or, if you prefer, the second section of it.

If you want in the reduced url also http or https, you could use this:

your_search | rex "^(?<url>(https|http):\/\/\w+\/\w+\/)"

Ciao.

Giuseppe

Re: How to do a regex for break an url after the fourth slash?

jip31 — Tue, 17 May 2022 07:39:05 GMT

it doesnt works

Re: How to do a regex for break an url after the fourth slash?

gcusello — Tue, 17 May 2022 07:43:00 GMT

Hi @jip31,

the regex works on regex101.com: https://regex101.com/r/4kTIF3/2

could you share a sample of your logs?

Ciao.

Giuseppe

Re: How to do a regex for break an url after the fourth slash?

ITWhisperer — Tue, 17 May 2022 07:48:34 GMT

It seems that the way you have phrased your question does not make it clear what it is you are trying to achieve - please can you give examples of the desired output so we might better be able to guide you to a solution?

Re: Help on regex for breaking an url

jip31 — Tue, 17 May 2022 07:54:34 GMT

If the URL is https://xxxx/yyyy/test, I need to display

https://xxxx/yyyy

/test

in the same line

Re: Help on regex for breaking an url

ITWhisperer — Tue, 17 May 2022 08:05:46 GMT

| eval url=replace(url,"(?<part1>\w+:(\/.*){4})(?<rest>.*)","\1 \2")

Re: Help on regex for breaking an url

gcusello — Tue, 17 May 2022 08:06:21 GMT

Hi @jip31,

let me understand, you want two fields from your url:

in the first "https://xxxx/yyyy"
in the second "/test"

if this is your need, please try this:

your_search | rex "^(?<url1>(https|http):\/\/\w+\/\w+)(?<url2>\/[^ ]+)"

if the url in another extracted field (called e.g. original_url), you could use:

your_search | rex field=original_url "^(?<url1>(https|http):\/\/\w+\/\w+)(?<url2>\/[^ ]+)"

you can test the new regex at https://regex101.com/r/4kTIF3/3

Ciao.

Giuseppe

Re: Help on regex for breaking an url

jip31 — Tue, 17 May 2022 08:18:00 GMT

it sounds like this but when I say that I want to cut after the fourfth /, the double / after https have to be taken into account

so in my example, the cut has to be done just before / test

and other point, /test has to be cut and paste and not copy and paste

https://xxxx/yyyy/test

Re: Help on regex for breaking an url

jip31 — Tue, 17 May 2022 08:24:09 GMT

always not good...

it breaks anything

Re: Help on regex for breaking an url

ITWhisperer — Tue, 17 May 2022 08:43:37 GMT

Sorry, the double slash was messing with the result. Try this

| eval updated=replace(url,"(?<part1>\w+:\/\/[^\/]*\/[^\/]*)(?<rest>.*)","\1 \2")

Re: Help on regex for breaking an url

jip31 — Tue, 17 May 2022 09:56:06 GMT

perfect ITWhisperer, many thanks