topic Re: Need help with a regex please. (Defining an action by user) in Splunk Search

Need help with a regex please. (Defining an action by user)

tengugurl1 — Fri, 30 Aug 2024 17:30:00 GMT

I have a standard printed statement that shows something like this:

[29/Aug/2024:23:59:48 +0000] "GET /rest/LMNOP
[29/Aug/2024:23:59:48 +0000] "POST /rest/LMNOP
[29/Aug/2024:23:59:48 +0000] "PUT /rest/LMNOP
[29/Aug/2024:23:59:48 +0000] "DELETE /rest/LMNOP

I don't have a defined field called "ActionTaken" in the sense, was the user doing a put, post or get etc..

Is there a simple regex that would give me something to add to a query that would define a variable called

"ActionTaken"

tried this:
rex "\//rest/s*(?<ActionTaken>\d{3})"

But it comes back with nothing

Re: Need help with a regex please. (Defining an action by user)

richgalloway — Fri, 30 Aug 2024 17:43:26 GMT

The existing rex command is searching for 3 digits following "rest", which does not match the sample text. Try this command

| rex "\\\"(?<method>\w+) \/rest\/(?<ActionTaken>.*)"

Re: Need help with a regex please. (Defining an action by user)

thx — Fri, 30 Aug 2024 17:44:14 GMT

try something like...

| rex field=_raw ".*\/rest\/(?<ActionTaken>\w+)"

Re: Need help with a regex please. (Defining an action by user)

PickleRick — Fri, 30 Aug 2024 22:15:39 GMT

1. Use regex101.com - it's a great tool for testing regexes.

2. Remember to escape backslashes and quotes if you use regex as a sting argument to the rex command.

3. Your regex would match three-digit-long parts of request path after the "//rest/" part (which doesn't appear in yiur events anyway), not the http method.

4. You need something like

| rex "\\]\\s+(?<ActionTaken>\\S+)\\s/"

(If you want to test it on regex101.com, remove extra backslashes)

Re: Need help with a regex please. (Defining an action by user)

tengugurl1 — Tue, 03 Sep 2024 18:32:50 GMT

May I ask another silly question,
I am getting closer to what I need, if I had the following examples:

/rest/Apple/1.0/
/rest/Banana/2/
/rest/structure/2.0/

How could I define a variable via regex to best tease out whats an apple, banana and or structure

I tried what you provided below but its giving me the full log.
I just need it to show:

| rex "rest/***/***"(?<method>\w+) \/rest\/(?<ActionTaken>.*)" AKA Action taken would be equal to apple, banana or structure

Apple 1.0

or Banana 2

structure 2.0. (TLDR basically anything after rest/*/*/

Re: Need help with a regex please. (Defining an action by user)

richgalloway — Tue, 03 Sep 2024 20:12:07 GMT

Since the new sample events don't have a method field (GET, POST, etc.), we can get rid of that part of the regex.

| rex "\/rest\/(?<field1>[^\/]+)\/(?<field2>.*)"