topic Re: How do I edit my regular expression to extract a field from my sample log event? in Splunk Search

How do I edit my regular expression to extract a field from my sample log event?

namritha — Mon, 12 Sep 2016 19:09:27 GMT

Hi,
I am trying to extract a field from a log event, but need help as my RegEx seems to be wrong.

Input string:

2011-07-11 14:45:59,965 | PERF  | [http-jboss-vm-a1b25.prod.v3-nonpid-brown.cloud.ab.com/12.47.5.87:8223-34] | [com.ab.fap.webser.client.RestServiceClient] | [0b108g34-9529-707c-6e2c-fd510206d1md] | [] | TIME: (0) 2011/07/11 14:45:59:943 to 14:45:59:965 19 ms. https://abcdefapi.ab.com/v4/sof/bcp/{ssf_nuid}

Regular expression used: ^(?:[^:\n]*:){10}\d+\s+\d+\s+\w+\.\s+

The regular expression matches the string up to ms as given below,

I want to extract anything after ms i.e. the value "https://abcdefapi.ab.com/v4/sof/bcp/{ssf_nuid}" in this case.
Please tell me what is incorrect in the below command or what the correct command is.

Command used:
source="abc.log"|rex field=_raw "^(?:[^:\n]*:){10}\d+\s+\d+\s+\w+\.\s+(?P)\w+" does not extract

NOTE: All field values have been changed to dummy values and do not represent the real configurations.

Re: How do I edit my regular expression to extract a field from my sample log event?

richgalloway — Mon, 12 Sep 2016 20:31:44 GMT

You're falling into the common trap of trying to match more than is necessary. If you're only interested in the URL, then write a regex for a URL. This works with your sample.

source="abc.log" | rex "(?<url>http[s]:\/\/.*)" | ...

Re: How do I edit my regular expression to extract a field from my sample log event?

sundareshr — Mon, 12 Sep 2016 20:32:47 GMT

If you just want to capture everything after ms till the end, you can use this regex

\d+\s+ms\.\s+(?<url>.*)

Re: How do I edit my regular expression to extract a field from my sample log event?

MuS — Mon, 12 Sep 2016 20:40:11 GMT

upvote on this, because it matches in less steps and therefore is much faster 😉