Dashboards & Visualizations

parsing URL regex

asdfxqwert
Explorer

I need help with regex for parsing a URL

 

The URL can be  a/b/c, a/b/c/d or a/b/c/d/e

In any case I need the resource of the URL -  c d e respectively for the above URLs. Can you help with a regex which can give the value after the last / 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

See the rex statement here

| makeresults
| eval urls=split("a/b/c,a/b/c/d,a/b/c/d/e",",")
| mvexpand urls
| rex field=urls ".*/(?<resource>.*)"

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

See the rex statement here

| makeresults
| eval urls=split("a/b/c,a/b/c/d,a/b/c/d/e",",")
| mvexpand urls
| rex field=urls ".*/(?<resource>.*)"
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...