topic Re: Error parsing URL in Splunk in Splunk Search

How to solve Error parsing URL in Splunk?

Badab — Fri, 28 Apr 2023 14:00:57 GMT

Hello,

I'm trying to parse URLs in Java logs (*.trace), it works for complete URL with this following request :

index=os_win_wks sourcetype="os_win_wks:java:trace"
| rex field=_raw (?<URL>https?:\/\/\S+)

but I want to stop to the first "/" with this one, then I have an error message :

index=os_win_wks sourcetype="os_win_wks:java:trace"
| rex (?<url>https?:\/\\[^:\/]+)

Error => Error in 'SearchParser': Missing a search command before '^'. Error at position '75' of search query 'search index=* sourcetype="os_win_wks:java:trace" ...{snipped} {errorcontext = tps?:\/\\[^:\/]+)}'.

Could you help me please ?

Error parsing URL in Splunk

javiergn — Fri, 28 Apr 2023 08:08:50 GMT

Hi @Badab , I think there is a typo as you did not escape a forward slash but a backslash.

It should be like:

| rex "(?<url>https?:\/\/[^:\/]+)"

I've tested it and it seems to do what you are asking:

Regards,

Re: Error parsing URL in Splunk

Badab_one — Tue, 02 May 2023 08:52:30 GMT

It works, thank you !