Archive

How to create a search to extract last word of the URL?

Path Finder

I need to create a search which extract last word of the URL as below:-

https://hostname/bs/cf/webservice/WordtoExtract ...

Please let me now how to extract last word of above URL i.e WordtoExtract.

Tags (1)

Builder

Lots of ways to solve this. Positive lookbehind is worth exploring!

 | makeresults 
 | eval url="https://hostname/bs/cf/webservice/WordtoExtract" 
 | rex field=url "(?<=\/)(?<theWord>\w+)$"

Regex101: https://regex101.com/r/eslxJR/1

0 Karma

Esteemed Legend

Like this:

... | rex field=url "\/(?<lastURLword>[^\/]+)$"
0 Karma

Champion

Hi

Try this too

| makeresults 
| eval url="https://hostname/bs/cf/webservice/WordtoExtract" 
| eval temp=split(url,"/") 
| eval output = mvindex(temp,mvcount(temp)-1)
0 Karma

Ultra Champion
| makeresults 
| eval url="https://hostname/bs/cf/webservice/WordtoExtract" 
| eval output = mvindex(split(url,"/") ,-1)

That's enough.

0 Karma

SplunkTrust
SplunkTrust

@bsaujla131984 ,

Try

|rex field=URL "\/(?<last_word>[^\/]*)$"
0 Karma