Splunk Search

Extract Field URL

Path Finder

How to do rex to extract field URL eg.: http://www.gnookcooki.com.br

1366974288.183 102 178.19.3.199 TCPREFRESHHIT/200 174 GET http://www.gnookcooki.com.br/images/hat_orange_big.gif teste@teste.com DIRECT/www.gnookcooki.com.br/image/gif
1366974288.184 102 178.19.3.199 TCPREFRESHHIT/200 174 GET http://www.gnookcooki.com.br/images-files/hat_orange.jpg teste@teste.com DIRECT/www.gnookcooki.com.br/image/gif

Tags (2)
0 Karma

SplunkTrust
SplunkTrust

your_search | rex field=_raw "(GET|POST|DELETE|PUT)\s*(?<url>[^\s]*)"

Although, this looks like access_combined, some items should be extracted for you already.

Champion

Here another one that may work for you as well.
(?<uri>(https?|ftp)://[a-zA-Z0-9.\-_]+/[a-zA-Z0-9+&@#/%=~_\-|!:,.;]*)

0 Karma