topic Re: Regex assistance in Splunk Search

Regex assistance

ddrillic — Mon, 20 Feb 2017 17:36:22 GMT

We have a field such as - activity="POST->/cirrus/v1.0/providers"
We would like to extract everything after the POST->/cirrus/v1.0/ part.

What would be a way to do it?

Re: Regex assistance

ddrillic — Mon, 20 Feb 2017 17:50:14 GMT

Sorry sorry - | rex field=activity "POST->/cirrus/v1.0/(?<activity_clean>[a-z]+)" did it...

Re: Regex assistance

DalJeanis — Mon, 20 Feb 2017 18:00:11 GMT

1) is "POST" the only verb you want it for? 2) are there always exactly three slashes in the part you don't want?

Re: Regex assistance

ddrillic — Mon, 20 Feb 2017 18:03:12 GMT

That's exactly it ; -)

Re: Regex assistance

DalJeanis — Mon, 20 Feb 2017 18:07:15 GMT

This will pull that exact section out of a field called myfield and place it into a field called otherstuff

| rex field=myfield  "POST->\/[^\/]+\/[^\/]+\/(?<otherstuff>[^\"]+)"

This will do that and also put the verb into a field called whatverb.

| rex field=myfield  "(?<whatverb>POST|DELETE|GET|PUT)->\/[^\/]+\/[^\/]+\/(?<otherstuff>[^\"]+)"

Re: Regex assistance

ddrillic — Mon, 20 Feb 2017 19:29:08 GMT

Perfect!!!

Re: Regex assistance

DalJeanis — Mon, 20 Feb 2017 19:40:11 GMT

Ah, you meant that value within quotes was the value of the activity field.

I'd suggest changing that to one of the following -
| rex field=activity "POST->/cirrus/v1.0/(?.+)"
or
| rex field=activity "POST->/cirrus/v1.0/(?\w+)"

...since you probably can't be sure that it will always be only lower-case alpha characters. You also don't know when the cirrus version might change, so you might want to wildcard that as well. I tested this as below.

| makeresults | eval activity="POST->/cirrus/v1.0/providers"  
| rex field=activity  "POST->/cirrus/[^/]+/(?<activity_clean>.+)"

I was a little surprised the slashes didn't have to be escaped, although the code DID accept escaping them. Live and learn.

Re: Regex assistance

DalJeanis — Mon, 20 Feb 2017 19:40:44 GMT

please accept your answer to close the question.

Re: Regex assistance

ddrillic — Mon, 20 Feb 2017 19:41:59 GMT

I was surprised also about the non-escaping ; -)