Getting Data In

How to resolve the parsing of key value pairs in a URL?

New Member

I have log data that contains URLs like the example below. The automatic parsing of key value pairs works very well. All of the key value pairs after the question mark are parsed correctly, I see a field for every key after the question mark.


The problem is that the query string in the URL field (everything before the ?) looks like the following. It always has the first key/value pair after the ?


Trying to figure out the best way to make the URL field consistently have just the search string.
I've used a regex similar to this: | rex field=url mode=sed "s/\?.*//" Is there a better way?

Search head version 6.4.2

Hope this is enough info. Happy to provide more if needed.

0 Karma


If you only want the querystring (everything after the ?), try this


and for everything before the ?, use this

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...