topic Splunk parse url path value (not query parameter) in Splunk Search

Splunk parse url path value (not query parameter)

srinathv77 — Thu, 15 May 2014 20:49:21 GMT

www-pcm-com/p/Logitech-Keyboards/product~dpno~8146199~pdp.gbhdbgh

How can i get the value 8146199 (which will always be followed by "~dpno~" ?

I want only 8146199.

somesoni2 — Thu, 15 May 2014 20:54:25 GMT

Try this

..your base search ..| rex field=url "dpno~(?<YourFieldName>[^~]+)"

srinathv77 — Thu, 15 May 2014 20:58:04 GMT

Thank you for quick response.

linu1988 — Thu, 15 May 2014 21:32:07 GMT

Try this

sourcetype=xxx| rex field=_raw/field_name "~dpno~(?<Val>\\d+)" |table Val

field_name= address/ something which has been extracted by splunk