topic Re: How to edit my regular expression to extract URI from URL? in Splunk Search

How to edit my regular expression to extract URI from URL?

xxdesmus — Sun, 22 Jan 2017 20:07:50 GMT

Hey folks, sorry for asking this type of regex question yet again.

I have values like this in a field called "url":

http://8.8.8.8/file.sh
http://1.1.1.1/file2.sh
http://8.8.4.4/file3.sh

I'm trying to use rex to grab just the URI following the last " / " so I end up with a list like this:

file.sh
file2.sh
file3.sh

I was trying to accomplish this using source=cowrie url=* | rex field=uri "\/(?<url>\w+)\s" | table uri but I'm 99% sure my regular expression is wrong.

Any help would be greatly appreciated!

Re: How to edit my regular expression to extract URI from URL?

somesoni2 — Sun, 22 Jan 2017 20:46:38 GMT

Give these a try (remove head command after testing)

source=cowrie url=* | head 100 | table url| rex field=url "\/(?<uri>\w+\.\w+)$"

source=cowrie url=* | head 100 | table url| rex field=url "^\w+:\/\/[^\/]+\/(?<uri>.+)$"

Re: How to edit my regular expression to extract URI from URL?

xxdesmus — Sun, 22 Jan 2017 20:55:34 GMT

You are a genius. Thanks!