topic Re: Regular expression for a pattern in Splunk Search

Regular expression for a pattern

xvxt006 — Fri, 06 Jun 2014 18:48:26 GMT

Hi we have some uri's as shown below which have 2 words (/verify/abrasives) before /ecatalog and 3 words and 4 words. I want to get the uri's only after /ecatalog

/verify/abrasives/ecatalog/N-bi1/Ntt-3M+Abrasives
/verify/bearings/power-transmission/ecatalog/N-aoj
/verify/abrasive-cut-on/power-saws-and-accessories/power-tools/ecatalog/N-caiZ1z0d6at

i have tried like this but it did not give me proper results. Any suggestions?

Base search | rex field=uri_path ".*?(?[^(?:/ecatalog)]+)"

Re: Regular expression for a pattern

richgalloway — Fri, 06 Jun 2014 19:26:23 GMT

This worked for me on RegExr using your sample data.

rex field=uri_path "(?<custom>(\/verify[\/[\S]*))\/ecatalog"

Re: Regular expression for a pattern

xvxt006 — Fri, 06 Jun 2014 19:53:50 GMT

Thanks. This gives me before /ecatalog. I want the part which is after ecatalog.

Re: Regular expression for a pattern

somesoni2 — Fri, 06 Jun 2014 20:19:21 GMT

Try this

Your base search| rex field=uri "/ecatalog(?<custom>.*)"