topic Help with regex to extract a string? in Splunk Search

Help with regex to extract a string?

Pramodkuber — Tue, 29 Sep 2020 17:03:19 GMT

Need to fetch API name from URL.
e.g. base_url/products_support/system_name/api-name?parameters

Here I need to fetch "system_name/api-name" string between "product_support" and "?".

Any inputs which regex needs to use here?

Re: Help with regex to extract a string?

woodcock — Fri, 01 Dec 2017 21:48:05 GMT

Like this:

| rex field=YourFieldHere "(?<base_url>[^\/?]+)\/(?<producst_support>[^\/?]+)\/(?<system_name>[^\/?]+)\/(?<api_name>[^\/?]+)?(?<parameters>.*)$"

Re: Help with regex to extract a string?

Pramodkuber — Tue, 29 Sep 2020 17:16:51 GMT

Thanks a lot for your inputs. This is really very helpful. But I have few URLs where parameters are coming in path instead of queryparams.
How to take care of that? any idea?

e.g.
v2/customers/{customerID}/tickets
v2/customers/123456/tickets
v2/customers/987654/tickets

When I use "| stats values(api_name)" I am getting very big list as customer ID are different. I am looking result for 2/customers//tickets
"" should take care of all dynamic values for customer Ids and " stats values(api_name)" sjoul return only one row for "v2/customers/*/tickets"