topic Re: How to extract id from url message? in Splunk Search

How to extract id from url message?

Span — Wed, 02 Nov 2022 22:57:17 GMT

Hi, I have below message and Iam trying to use rex to extract the id... But myid always shows empty.. Please help

- - [02/Nov/2022:17:43:03 -0400] "PUT /application/resources/cat/v7/product/1234567890003/status HTTP/1.1" 201 - abcd.com - 8 web-614

rex field=msg "/application/resources/cat/v7/product/(?<myid>[0-9]*)/status" | table myid

Re: How to extract id from url message?

richgalloway — Wed, 02 Nov 2022 23:59:10 GMT

Slashes in regular expressions must be escaped.

rex field=msg "\/application\/resources\/cat\/v7\/product\/(?<myid>[0-9]*)/status" | table myid

Re: How to extract id from url message?

johnhuang — Thu, 03 Nov 2022 01:43:26 GMT

The sample data looks like _raw rather than msg.

You can try something like this which extracts any 13 digit number nested between forward slashes. This could be more flexible depending on the variability of your data.

| rex "\/(?<myid>\d{13})\/" | table myid