Extracting field using rex for URL

JoshuaJohn — Mon, 15 Aug 2016 14:22:30 GMT

I have this search:

index=nitro_prod_ecomm sourcetype = nitro_access_log earliest=-30m@m | rex field=_raw "\d\d\:\d\d\:\d\d\s+(?\d+\.\d+)" | search ResponseTime>1

That gives me results like this:

10.022.020.203  10.200.130.180:7001 -   2016-08-15  01:09:02    4.55    GET   /product/nitro?skuId=11023031 skuId=11023031  200 124221]"

10.402.300.103  10.200.111.116:7001 -   2016-08-15  01:09:00    6.033   POST /myaccount/json/acc_nitro_login_json.jsp   -   302 0]"

I want to get "product" & "myaccount" into a field called page, basically whatever that first word is after GET, and POST

Any solutions? I can get the entire URL but I am unsure as to how to get just that first part.

Re: Extracting field using rex for URL

skoelpin — Mon, 15 Aug 2016 14:42:20 GMT

Try this

... | rex (?<page>(GET|POST)\s+\/(\w+))

topic Extracting field using rex for URL in Splunk Search

Extracting field using rex for URL

Re: Extracting field using rex for URL