topic Re: How to extract data using rex ? in Splunk Search

How to extract data using rex ?

anil1219 — Thu, 14 Mar 2024 16:59:19 GMT

Hi,

I want to extract value c611b43d-a574-4636-9116-ec45fe8090f8 from below.

Could you please let me know how I can do using rex field=httpURL

httpURL: /peerpayment/v1/payment/c611b43d-a574-4636-9116-ec45fe8090f8/performAction

Re: How to extract data using rex ?

gcusello — Thu, 14 Mar 2024 17:34:52 GMT

Hi @anil1219,

if the structure of the URL is fixed, you could use

| rex "\/\w+\/\w+\/\w+\/(?<your_field>[^\/]+)"

that you can test at https://regex101.com/r/K3yj0E/1

Cio.

Giuseppe

Re: How to extract data using rex ?

yuanliu — Thu, 14 Mar 2024 20:46:15 GMT

Or better, do not use regex because the URI has an inherent structure/convention that many APIs adhere to. (See, e.g., Re: How do I modify my rex command to remove direc...) What you ask is the second to last segment of HTTP_PATH variable in CGI standard.

| eval actionID = mvindex(split(httpURL, "/"), -2)

Semantic code is easier to maintain and in this case, potentially cheaper than regex.