topic Re: I want to extract information from this field within these specific parameters using a rex command in Splunk Search

I want to extract information from this field within these specific parameters using a rex command

m7787579 — Wed, 16 Aug 2017 16:47:02 GMT

Hi Splunker,

I wanted to use a rex command until Splunk can find below parameter in logs:
1) ?
2) sag
3) If both of the options are not there then full statement until the end to be extracted.

My Logs look like this. Any one of the example can come in my logs

Ex-1 "POST /services/api/cumulativeLogo?trespassxyz (I want data to be rexed as POST /services/api/cumulativeLogo)
Ex-2 "POST /services/api/cumulativeLogosag (data to be looked as POST /services/api/cumulativeLogo)
Ex-3 "POST /services/api/cumulativeLogosamplefull.lopend.parameter (data to be rexed as POST /services/api/cumulativeLogosamplefull.lopend.parameter )

Thanks in advance

Re: I want to extract information from this field within these specific parameters using a rex command

somesoni2 — Wed, 16 Aug 2017 17:36:47 GMT

Try this

your base search  | rex "\"(?<URI>.+)(\?|sag|$)"

See it working with sample data here: https://regex101.com/r/ApNEXM/1

Re: I want to extract information from this field within these specific parameters using a rex command

sbbadri — Wed, 16 Aug 2017 17:48:51 GMT

try this,