topic Re: How to extract a content or string between 2 strings in Splunk Search

How to extract a content or string between 2 strings

sekhar463 — Wed, 15 Jun 2022 09:44:45 GMT

AL9851 | Z1 | [https://example1.com/] recording played asia location is Down

AL9851 | Z1 | [http://alphabeta/] recording played from asia location is Down

AL9851 | Z1 | [http://alphabeta/] recording played from US location is Down

i have above log from that need to extract URL .as URL varies but content is same before and after URL .

Re: How to extract a content or string between 2 strings

bowesmana — Tue, 14 Jun 2022 18:51:39 GMT

Use

| rex "\[(?<url>http[^\]]*)\]"

assuming you are parsing _raw field

I am assuming your example has 3 rows with 3 urls. The field name extracted above will be url

Re: How to extract a content or string between 2 strings

gcusello — Wed, 15 Jun 2022 06:34:03 GMT

@sekhar463,

you could try this:

| rex "^([^\|]+\|\s+){2}\[(?<URL>[^\]]+)\]"

that you can test at https://regex101.com/r/2HDtmM/1

Ciao.

Giuseppe

Re: How to extract a content or string between 2 strings

sekhar463 — Wed, 15 Jun 2022 09:27:47 GMT

Thanks it works

but what is it means parsing _raw field

Re: How to extract a content or string between 2 strings

sekhar463 — Wed, 15 Jun 2022 09:28:03 GMT

thanks

that works

Re: How to extract a content or string between 2 strings

sekhar463 — Wed, 15 Jun 2022 09:30:40 GMT

thanks it works

but is both rex works as same

| rex "^([^\|]+\|\s+){2}\[(?<URL>[^\]]+)\]"

| rex "\[(?<url>http[^\]]*)\]"

Re: How to extract a content or string between 2 strings

gcusello — Wed, 15 Jun 2022 09:32:01 GMT

Hi @sekhar463

the phrase from @bowesmana means that using the rex command you can extract a field from the entire raw log (without specifying any field) as in your case, or specifying a field.

Ciao.

Giuseppe

Re: How to extract a content or string between 2 strings

sekhar463 — Wed, 15 Jun 2022 09:49:10 GMT

Thank you

Re: How to extract a content or string between 2 strings

gcusello — Wed, 15 Jun 2022 14:00:24 GMT

Hi @sekhar463,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉