Splunk Search

Another regex

dbcase
Motivator

Hi,

I have this data

10.210.192.15 - - [02/Oct/2017:19:59:59 -0400] "GET /rest/icontrol/sites/278318/eventsByDay?startDate=2017-10-01&endDate=2017-10-01&maxResults=65536 HTTP/1.1" 200 16242 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-"  "-"


10.210.192.15 - - [02/Oct/2017:19:59:59 -0400] "GET /rest/icontrol/sites/304496/templates/triggerTemplates HTTP/1.1" 401 6 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-"  "-"

I need to get "eventsByDay" from the first line and "TriggerTemplates" from the second line

I've tried this regex

rex "\/(?[^\/\s]+)\sHTTP" (this one works for the second one just fine)
rex "\/(?[^\/\s]+)\?" (this one works for the first line just fine)

I'm running into trouble on how to combine the 2 regex into one. Any thoughts?

Tags (2)
0 Karma
1 Solution

chanfoli
Builder

This appears to work with your 2 examples:

\/(?<function>\w*)(\s|\?)

View solution in original post

0 Karma

chanfoli
Builder

This appears to work with your 2 examples:

\/(?<function>\w*)(\s|\?)
0 Karma

dbcase
Motivator

Hi Chanfoli,

Wow, many thanks! Worked like a champ!

0 Karma

dbcase
Motivator

Tried this one too..... close but still not quite it

\/(?<function>[^\/\s]+)(\?|\sHTTP)
0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...