/api/v1/user/engines/forecast/xyz?abc=true
For the above URL, I want to display the URL in the table till xyz (/api/v1/user/engines/forecast/xyz).
I am using the following regex
| regex requestURI = _raw "/[^?]*/" // not include data after ?
| regex requestURI = ".*[^.txt]$" // no .txt extensions in the URI
| regex requestURI = "/[0-9a-zA-Z]{3,}/" // minimum length should be 3
But the first one is not working and the whole URL is being displayed
You are confusing regex
with rex
. Try this:
|makeresults | eval _raw="/api/v1/user/engines/forecast/xyz?abc=true"
| rex "^(?<requestURI1>/[^?]*/)"
| rex "(?<requestURI2>.*[^.txt])$"
| rex "(?<requestURI3>/[0-9a-zA-Z]{3,}/)"
You are confusing regex
with rex
. Try this:
|makeresults | eval _raw="/api/v1/user/engines/forecast/xyz?abc=true"
| rex "^(?<requestURI1>/[^?]*/)"
| rex "(?<requestURI2>.*[^.txt])$"
| rex "(?<requestURI3>/[0-9a-zA-Z]{3,}/)"
Hi prannoy93singh,
to match /
you need to escape them in the regex, try this:
\/[^?]+
cheers, MuS
I tried running the above query, but it is still not giving the desired result.
/api/v1/user/abc/xyz/24966700::2?personalizationChannel=ADVISOR_CENTER
such queries are still showing
Use rex
instead, test it with this run everywhere example:
| makeresults
| eval foo="/api/v1/user/abc/xyz/24966700::2?personalizationChannel=ADVISOR_CENTER"
| rex field=foo "(?<MyNewField>\/[^?]+)"
the field MyNewField
has the value of /api/v1/user/abc/xyz/24966700::2
in this example.
cheers, MuS