topic Re: How to match start of field string using regex? in Splunk Search

How to match start of field string using regex?

mhulse — Fri, 24 Feb 2023 03:05:56 GMT

Hello,

I am trying to match the start of a path in httpRequest.uri, as seen here:

index=xyz source=xyz 
| spath "httpRequest.headers{}.value"
| search "httpRequest.headers{}.value"="application/json"
| spath "httpRequest.uri"
| regex "^/public*"
| stats count by "httpRequest.uri"
| sort -count

Unfortunately, it isn't working.

Can someone point out what I am doing wrong here?

If I get rid of the caret, the regex works, but it matches anywhere within the field’s string value. I need to start from the beginning of the string.

Thank you so much in advance!

Re: How to match start of field string using regex?

scelikok — Fri, 24 Feb 2023 03:18:18 GMT

Hi @mhulse,

regex command works on _raw as a default. You need to tell the field like below;

index=xyz source=xyz | spath "httpRequest.headers{}.value" | search "httpRequest.headers{}.value"="application/json" | spath "httpRequest.uri" | regex "httpRequest.uri"="^/public.*" | stats count by "httpRequest.uri" | sort -count

Re: How to match start of field string using regex?

mhulse — Fri, 24 Feb 2023 03:34:07 GMT

Thank you so much @scelikok!!! I greatly appreciate your help! 🙂