topic How to extract fields with differing lengths from cs-uri-stem entries? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-with-differing-lengths-from-cs-uri-stem/m-p/209211#M61118 <P>Hello,</P> <P>I am trying to pull certain criteria out of cs-uri-stem that contain different lengths for cs-uri-stem. I am trying to get one field extraction from all the examples.</P> <P>Here are some examples of the cs_uri_stem entries:</P> <P>/<STRONG>apps/orderalert</STRONG>/default.aspx<BR /> /<STRONG>netpub</STRONG>/ser.np<BR /> /<STRONG>apps/ajt/a2dsfile/files</STRONG>/dll/data.dll<BR /> /<STRONG>apps/ajt/SE3SPXWEBSERVICE</STRONG>/SpxSE3WebService.asmx<BR /> /<STRONG>aspnet_client/system_web/2_0_50727/Themes/Normal/images</STRONG>/sss_head_bg.gif</P> <P>The goal is to get everything minus the last bit and the "/" at the beginning and end. I have highlighted what it is I want to get out of cs_uri_stem. If I need to post more from the log files I can.</P> <P><STRONG>apps/orderalert</STRONG><BR /> <STRONG>netpub</STRONG><BR /> <STRONG>apps/ajt/a2dsfile/files</STRONG><BR /> <STRONG>apps/ajt/SE3SPXWEBSERVICE</STRONG><BR /> <STRONG>aspnet_client/system_web/2_0_50727/Themes/Normal/images</STRONG></P> Tue, 29 Sep 2020 11:06:41 GMT patelpin 2020-09-29T11:06:41Z How to extract fields with differing lengths from cs-uri-stem entries? https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-with-differing-lengths-from-cs-uri-stem/m-p/209211#M61118 <P>Hello,</P> <P>I am trying to pull certain criteria out of cs-uri-stem that contain different lengths for cs-uri-stem. I am trying to get one field extraction from all the examples.</P> <P>Here are some examples of the cs_uri_stem entries:</P> <P>/<STRONG>apps/orderalert</STRONG>/default.aspx<BR /> /<STRONG>netpub</STRONG>/ser.np<BR /> /<STRONG>apps/ajt/a2dsfile/files</STRONG>/dll/data.dll<BR /> /<STRONG>apps/ajt/SE3SPXWEBSERVICE</STRONG>/SpxSE3WebService.asmx<BR /> /<STRONG>aspnet_client/system_web/2_0_50727/Themes/Normal/images</STRONG>/sss_head_bg.gif</P> <P>The goal is to get everything minus the last bit and the "/" at the beginning and end. I have highlighted what it is I want to get out of cs_uri_stem. If I need to post more from the log files I can.</P> <P><STRONG>apps/orderalert</STRONG><BR /> <STRONG>netpub</STRONG><BR /> <STRONG>apps/ajt/a2dsfile/files</STRONG><BR /> <STRONG>apps/ajt/SE3SPXWEBSERVICE</STRONG><BR /> <STRONG>aspnet_client/system_web/2_0_50727/Themes/Normal/images</STRONG></P> Tue, 29 Sep 2020 11:06:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-with-differing-lengths-from-cs-uri-stem/m-p/209211#M61118 patelpin 2020-09-29T11:06:41Z Re: How to extract fields with differing lengths from cs-uri-stem entries? https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-with-differing-lengths-from-cs-uri-stem/m-p/209212#M61119 <P>Try this</P> <PRE><CODE>base search | rex field=cs_uri_stem "\/(?&lt;fld&gt;.*)\/" </CODE></PRE> Wed, 21 Sep 2016 20:07:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-with-differing-lengths-from-cs-uri-stem/m-p/209212#M61119 sundareshr 2016-09-21T20:07:23Z Re: How to extract fields with differing lengths from cs-uri-stem entries? https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-with-differing-lengths-from-cs-uri-stem/m-p/209213#M61120 <P>This worked great, thanks. I was able to use "\/(?.*)\/ in cs_uri_stem" to make it work for me.</P> Tue, 29 Sep 2020 11:13:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-with-differing-lengths-from-cs-uri-stem/m-p/209213#M61120 patelpin 2020-09-29T11:13:06Z