Splunk Search

Another regex

dbcase
Motivator

Hi,

I have this data

10.210.192.15 - - [02/Oct/2017:19:59:59 -0400] "GET /rest/icontrol/sites/278318/eventsByDay?startDate=2017-10-01&endDate=2017-10-01&maxResults=65536 HTTP/1.1" 200 16242 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-"  "-"


10.210.192.15 - - [02/Oct/2017:19:59:59 -0400] "GET /rest/icontrol/sites/304496/templates/triggerTemplates HTTP/1.1" 401 6 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-"  "-"

I need to get "eventsByDay" from the first line and "TriggerTemplates" from the second line

I've tried this regex

rex "\/(?[^\/\s]+)\sHTTP" (this one works for the second one just fine)
rex "\/(?[^\/\s]+)\?" (this one works for the first line just fine)

I'm running into trouble on how to combine the 2 regex into one. Any thoughts?

Tags (2)
0 Karma
1 Solution

chanfoli
Builder

This appears to work with your 2 examples:

\/(?<function>\w*)(\s|\?)

View solution in original post

0 Karma

chanfoli
Builder

This appears to work with your 2 examples:

\/(?<function>\w*)(\s|\?)
0 Karma

dbcase
Motivator

Hi Chanfoli,

Wow, many thanks! Worked like a champ!

0 Karma

dbcase
Motivator

Tried this one too..... close but still not quite it

\/(?<function>[^\/\s]+)(\?|\sHTTP)
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...