Split url and extract values

[balash1979]

When I run my Splunk query, I get url field and the value of the field is like this
https://location-server-aks-611ab294.test.australia.azm.io:443/api

I would like to extract the words "location" and "server" from the above value. How can I accomplish this ?

[Richfez]

If they'll always be in the same place in the string, and will always be delimited by dashes...

mysearch | rex "https:\/\/(?<first_string>[^-]*)-(?<second_string>[^-]*)"

That will retrieve the aptly named "first_string" and "second_string" from the first two '-' delimited things in the url after https.

A variation of that can be put in props to extract it always. For that, look at EXTRACT- or REPORT- props settings from the props.conf spec file