Archive

How to create a search to extract last word of the URL?

Path Finder

I need to create a search which extract last word of the URL as below:-

https://hostname/bs/cf/webservice/WordtoExtract ...

Please let me now how to extract last word of above URL i.e WordtoExtract.

Tags (1)

Builder

Lots of ways to solve this. Positive lookbehind is worth exploring!

 | makeresults 
 | eval url="https://hostname/bs/cf/webservice/WordtoExtract" 
 | rex field=url "(?<=\/)(?<theWord>\w+)$"

Regex101: https://regex101.com/r/eslxJR/1

0 Karma

Esteemed Legend

Like this:

... | rex field=url "\/(?<lastURLword>[^\/]+)$"
0 Karma

Champion

Hi

Try this too

| makeresults 
| eval url="https://hostname/bs/cf/webservice/WordtoExtract" 
| eval temp=split(url,"/") 
| eval output = mvindex(temp,mvcount(temp)-1)
0 Karma

Ultra Champion
| makeresults 
| eval url="https://hostname/bs/cf/webservice/WordtoExtract" 
| eval output = mvindex(split(url,"/") ,-1)

That's enough.

0 Karma

SplunkTrust
SplunkTrust

@bsaujla131984 ,

Try

|rex field=URL "\/(?<last_word>[^\/]*)$"
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!