topic How to return a url only to the 2nd slash? in Splunk Search

How to return a url only to the 2nd slash?

isxtn — Mon, 07 Aug 2023 19:13:32 GMT

So, this PCRE regex works in testers, but not on Splunk.

^((http[s]?):\/)?\/?([^:\/\s]+)((\w+)*\/){2})

BUT in Splunk search, this:

rex field=referer "referer=(?<referer>^((http[s]?):\/)?\/?([^:\/\s]+)((\w+)*\/){2})

is returning the entire url, i.e., https://someurl.com/first/second/third/fourth/etc

What's the proper way to get what I'm looking for? Confused that this works in testers but not Splunk.

jotne — Fri, 04 Aug 2023 21:25:54 GMT

Just count 4 /

| makeresults | eval url="https://someurl.com/first/second/third/fourth/etc" | rex field=url "(?<test>^(?:[^\/]*\/){4})"

isxtn — Fri, 04 Aug 2023 21:36:00 GMT

Thanks!