Splunk Dev

How to rex a value in a request uri with a variable value in the middle?

mark_groenveld
Path Finder

We are looking to provide the last part of a request uri that identifies a file name and has a client identifier variable in the middle of the uri.

Sample uri request:
GET /someportal/rest/product/v1_0/clientidentifier/filename/fnm_123456789abcd.png HTTP/1.1

The underlined text is the value that I need to extract.  Note the space after the .png.

My current attempt is this:
index=index source=/source sourcetype=sourcetype | rex field=_raw "GET /someportal/rest/product/v1_0/*/filename/(?<FileName>\d+)"

Please let me know how far off I am.  Thanks

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You were close

| rex "GET \/someportal\/rest\/product\/v1_0\/.*\/filename\/(?<FileName>\S+)"

You should escape slashes, the asterisk is a greedy match but needs an any character preceding it, and the filename should be \S for any non-white-space ("note the space after the .png")

regex101.com is a good place to try out regex - it doesn't get it exactly right when treating backslahes, but it is pretty close https://regex101.com/r/fKABZf/1 

 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You were close

| rex "GET \/someportal\/rest\/product\/v1_0\/.*\/filename\/(?<FileName>\S+)"

You should escape slashes, the asterisk is a greedy match but needs an any character preceding it, and the filename should be \S for any non-white-space ("note the space after the .png")

regex101.com is a good place to try out regex - it doesn't get it exactly right when treating backslahes, but it is pretty close https://regex101.com/r/fKABZf/1 

 

mark_groenveld
Path Finder

That worked.  Many thanks!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...