Splunk Search

Extract Field URL

erick_costa
Path Finder

How to do rex to extract field URL eg.: http://www.gnookcooki.com.br

1366974288.183 102 178.19.3.199 TCP_REFRESH_HIT/200 174 GET http://www.gnookcooki.com.br/images/hat_orange_big.gif teste@teste.com DIRECT/www.gnookcooki.com.br/image/gif
1366974288.184 102 178.19.3.199 TCP_REFRESH_HIT/200 174 GET http://www.gnookcooki.com.br/images-files/hat_orange.jpg teste@teste.com DIRECT/www.gnookcooki.com.br/image/gif

Tags (2)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

your_search | rex field=_raw "(GET|POST|DELETE|PUT)\s*(?<url>[^\s]*)"

Although, this looks like access_combined, some items should be extracted for you already.

bmacias84
Champion

Here another one that may work for you as well.
(?<uri>(https?|ftp)://[a-zA-Z0-9.\-_]+/[a-zA-Z0-9+&@#/%=~_\-|!:,.;]*)

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...