Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Another regex
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have this data
10.210.192.15 - - [26/Sep/2017:19:59:59 -0400] "POST /rest/icontrol/sites/315568/network/instances/100876ffe9572a.0/functions/disarm HTTP/1.1" 202 9 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "
10.210.192.5 - - [26/Sep/2017:19:59:59 -0400] "POST /rest/icontrol/sites/4793/network/instances/140024460000052928.10.0/functions/thermostatStatus HTTP/1.1" 202 9 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-" "-"
6:59:59.000 PM
10.210.192.15 - - [26/Sep/2017:19:59:59 -0400] "GET /rest/icontrol/sites/4793/network/lights/getAllLightingStatus HTTP/1.1" 202 9 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-" "-"
And I think I need to do a backwards match (unless there is a better way). I need to match
disarm in the first event
thermostatStatus in the second event
getAllLightingStatus in the third event
I'm ok with regex but trying to wrap my mind around how to search backwards throws me for a loop!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Nothing backwards about it. We want a chunk that occurs between a slash "/" and the letters " HTTP". We want to make sure not to match the space \s or any other slashes \/.
Thus, we create a character type that matches anything but slash or whitespace [^\/\s], and capture however many of them there are, (but minimum one +) between our endpoints.
| rex "\/(?<mymatch>[^\/\s]+)\sHTTP"
Voila.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Nothing backwards about it. We want a chunk that occurs between a slash "/" and the letters " HTTP". We want to make sure not to match the space \s or any other slashes \/.
Thus, we create a character type that matches anything but slash or whitespace [^\/\s], and capture however many of them there are, (but minimum one +) between our endpoints.
| rex "\/(?<mymatch>[^\/\s]+)\sHTTP"
Voila.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
wow, that is pretty slick
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@dbcase - It's all in learning how to look at it. Sometimes you just have to take three steps back. Sometimes you have to cross your eyes. Sometimes you have to get out a chainsaw and cut a wall out of the way. 😉
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I can't wait to use the chainsaw! 🙂
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Event Series May & June: From Network Visibility to Service Intelligence
Global Splunk User Group Events: May + June 2026
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
