Another regex

[dbcase]

Hi,

I have this data

10.210.192.15 - - [02/Oct/2017:19:59:59 -0400] "GET /rest/icontrol/sites/278318/eventsByDay?startDate=2017-10-01&endDate=2017-10-01&maxResults=65536 HTTP/1.1" 200 16242 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-"  "-"


10.210.192.15 - - [02/Oct/2017:19:59:59 -0400] "GET /rest/icontrol/sites/304496/templates/triggerTemplates HTTP/1.1" 401 6 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-"  "-"

I need to get "eventsByDay" from the first line and "TriggerTemplates" from the second line

I've tried this regex

rex "\/(?[^\/\s]+)\sHTTP" (this one works for the second one just fine)
rex "\/(?[^\/\s]+)\?" (this one works for the first line just fine)

I'm running into trouble on how to combine the 2 regex into one. Any thoughts?

[chanfoli · Accepted solution]

This appears to work with your 2 examples:

\/(?<function>\w*)(\s|\?)

[dbcase]

Hi Chanfoli,

Wow, many thanks! Worked like a champ!

[dbcase]

Tried this one too..... close but still not quite it

\/(?<function>[^\/\s]+)(\?|\sHTTP)