How to write the regex in my search to extract first part of uri path in access logs?

puneetkharband1 — Thu, 22 Jan 2015 19:38:56 GMT

Below is the string I need to extract ROM_RAMESH from and similarly there are multiple client info so I need a regular expression and I am very new to that.
I used the extract field but can't get what I need ...

21.432.632.53 - - [14/Jan/2015:13:23:57 -0500] "GET /ROM_RAMESH/images/bg.gif HTTP/1.1" 200 64 - 38E8352722F7ADE88844A3B026752BCC.bgitcostumen1 - - https://cbsplake.boysdtom.com/ROM_RAMESH/BrandHistory.do -

When I use this:

 index="cc_web" sourcetype= * | rex field=_raw "(?i)^(?:[^\-]*\-){6}\s+(?P.+?)\w+\.\w+\s+" | top limit=100 Clients

I get only this as a result
https://cbsplake.boysdtom.com/ROM_RAMESH/

I need
ROM_RAMESH

Re: How to write the regex in my search to extract first part of uri path in access logs?

chanfoli — Thu, 22 Jan 2015 20:03:29 GMT

If your input is having the built-in httpd access transforms applied, you should have access to the uri_path field and this should work and give you a field called field1:

[your search]| rex field=uri_path "^/(?<field1>[^/]*)/"

If you are not using the access log transforms with this sourcetype then the following should also work for GET and POST requests:

 [your search] | rex field=_raw "(GET|POST)\s/(?<field1>[^/]*)/"

topic How to write the regex in my search to extract first part of uri path in access logs? in Splunk Search

How to write the regex in my search to extract first part of uri path in access logs?

Re: How to write the regex in my search to extract first part of uri path in access logs?