What rex to use for the extraction of virtual from URI?

lbonnes — Mon, 14 Nov 2022 18:52:34 GMT

These two cells are examples of results I see in IIs logs.

If the field is just a / (backslash) ( as in the first example data cell ) I want to return just the /.

If there are characters after the first / (like search in #2) , I need to return the text between the backslashes.

/search/20191108/master.svc

My results would look like this.

field1

root

Re: What rex to use for the extraction of virtual from URI?

richgalloway — Mon, 14 Nov 2022 21:29:23 GMT

This should do it.

| rex "\/(?<field1>[^\/]+)" | eval field1=if(isnull(field1) OR field1="","root", field1)

The rex command grabs everything between the first two slashes. The eval command presumes a missing or empty field1 means the root was specified.