Splunk Dev

How to rex a value in a request uri with a variable value in the middle?

mark_groenveld
Path Finder

We are looking to provide the last part of a request uri that identifies a file name and has a client identifier variable in the middle of the uri.

Sample uri request:
GET /someportal/rest/product/v1_0/clientidentifier/filename/fnm_123456789abcd.png HTTP/1.1

The underlined text is the value that I need to extract.  Note the space after the .png.

My current attempt is this:
index=index source=/source sourcetype=sourcetype | rex field=_raw "GET /someportal/rest/product/v1_0/*/filename/(?<FileName>\d+)"

Please let me know how far off I am.  Thanks

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You were close

| rex "GET \/someportal\/rest\/product\/v1_0\/.*\/filename\/(?<FileName>\S+)"

You should escape slashes, the asterisk is a greedy match but needs an any character preceding it, and the filename should be \S for any non-white-space ("note the space after the .png")

regex101.com is a good place to try out regex - it doesn't get it exactly right when treating backslahes, but it is pretty close https://regex101.com/r/fKABZf/1 

 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You were close

| rex "GET \/someportal\/rest\/product\/v1_0\/.*\/filename\/(?<FileName>\S+)"

You should escape slashes, the asterisk is a greedy match but needs an any character preceding it, and the filename should be \S for any non-white-space ("note the space after the .png")

regex101.com is a good place to try out regex - it doesn't get it exactly right when treating backslahes, but it is pretty close https://regex101.com/r/fKABZf/1 

 

mark_groenveld
Path Finder

That worked.  Many thanks!

0 Karma
Get Updates on the Splunk Community!

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...