Splunk Search

Another regex

dbcase
Motivator

Hi,

I have this data

10.210.192.15 - - [02/Oct/2017:19:59:59 -0400] "GET /rest/icontrol/sites/278318/eventsByDay?startDate=2017-10-01&endDate=2017-10-01&maxResults=65536 HTTP/1.1" 200 16242 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-"  "-"


10.210.192.15 - - [02/Oct/2017:19:59:59 -0400] "GET /rest/icontrol/sites/304496/templates/triggerTemplates HTTP/1.1" 401 6 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-"  "-"

I need to get "eventsByDay" from the first line and "TriggerTemplates" from the second line

I've tried this regex

rex "\/(?[^\/\s]+)\sHTTP" (this one works for the second one just fine)
rex "\/(?[^\/\s]+)\?" (this one works for the first line just fine)

I'm running into trouble on how to combine the 2 regex into one. Any thoughts?

Tags (2)
0 Karma
1 Solution

chanfoli
Builder

This appears to work with your 2 examples:

\/(?<function>\w*)(\s|\?)

View solution in original post

0 Karma

chanfoli
Builder

This appears to work with your 2 examples:

\/(?<function>\w*)(\s|\?)
0 Karma

dbcase
Motivator

Hi Chanfoli,

Wow, many thanks! Worked like a champ!

0 Karma

dbcase
Motivator

Tried this one too..... close but still not quite it

\/(?<function>[^\/\s]+)(\?|\sHTTP)
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...