Yet another regex question

dbcase — Tue, 29 Sep 2020 11:02:01 GMT

Hi,

I have data that looks like this

127.0.0.1 - dancase@icontrol.com [16/Sep/2016:15:34:57.025 +0000] "GET /en-US/splunkd/__raw/services/messages?output_mode=json&sort_key=timeCreated_epochSecs&sort_dir=desc&_=1474040107540 HTTP/1.0" 200 306 "https://icontrol.splunkcloud.com/en-US/app/search/cpe_diagnostics" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36" - a06114bf70eddcfcc771658760d1919d 0ms

I'm trying to match on the last segment of the URL

I have regex that looks like this

 rex "en-US/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)"

which sort of works.... it picks up the extra " at the end so in this case I get cpe_diagnostics" when all I want is cpe_diagnostics

Some of the other events have the same URL but without the trailing " and the regex works for those.

Re: Yet another regex question

twinspop — Sat, 17 Sep 2016 02:53:21 GMT

Add the double-quote to your exclusion class:

rex "en-US/app/(?<app>[^/]+)/(?<dashboard>[^?\s\"]+)"

Re: Yet another regex question

dbcase — Sat, 17 Sep 2016 02:55:56 GMT

Thanks twinspop!!!

Re: Yet another regex question

twinspop — Sat, 17 Sep 2016 02:57:58 GMT

No problemo. Glad I could help. 🙂

topic Re: Yet another regex question in Splunk Search

Yet another regex question

Re: Yet another regex question

Re: Yet another regex question

Re: Yet another regex question