topic Re: Help with Regex in Splunk Search

Help with Regex

ahogbin — Mon, 28 Sep 2020 19:01:17 GMT

Hello,

With my virtually non existent skills around regex I am struggling to get an extraction to work 😞

I am trying to extract some text after the third / as per the below
[http://10.91.11.47:1200/WMB_SAFIRE_INT/BCSWebservice/services/ProcessQuoteMB]

The text I want to extract is everything after the 3rd / so WMB_SAFIRE_INT/BCSWebservice/services/ProcessQuoteMB (the text content & length can vary but the start and end point of the text is consistent in that it starts with [http:// and ends with ]).
The result is then piped to a field(?) called WS (?)

Any help or pointers would be very much appreciated

Cheers,

Alastair

Re: Help with Regex

ramdaspr — Wed, 18 Feb 2015 03:57:36 GMT

Very rough attempt below. It should create a new field called WS, but it is specifially setup for 2 digit ip, you can change that to suit your setup

rex  field=fieldname  "\[http\:\/\/[0-9]{2}\.[0-9]{2}\.[0-9]{2}\.[0-9]{2}\:[0-9]{4}\/(?<WS>\S+)*\]"

Re: Help with Regex

ahogbin — Wed, 18 Feb 2015 04:25:59 GMT

Fantastic.. works a treat. Thank you so much.

Cheers,

Alastair

Re: Help with Regex

markthompson — Wed, 18 Feb 2015 09:45:05 GMT

Hi Alastair,
You should use the following regex for your field due to the fact that IP's can be 3 digit.

rex field=fieldname "\[http\:\/\/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\:[0-9]+\/(?<WS>\S+)*\]"

The + quantifier in essence says Any amount of any number in the range of 0 - 9

This should work, I haven't had a chance to test it, but I'm pretty sure it would work.