Splunk Search

Extract URL field in datamodel

user2020dy
Path Finder

Hello, guys

I`m trying to extract URL field from my log in Data Model (it is not extracted from _raw log and is not seen via index). I have found some variants in similar topics and added a new field (with regular expression) to Data Model. It does not cover 100% of my events, but it works.

photo5456289228813086673.jpg

However, I still don`t see this field when run the command

| from datamodel Network_Traffic

photo5456289228813086675.jpg

2 questions:

 

1) Can anyone answer me why the field is still not seen when whiting the search

| from datamodel Network)Traffic

Because the "Preview" tab shows the results and URLs are extracted 

 

2) Maybe you know how I can extract the field URL directly from _raw event, because I`m confused with all answers which I saw about this topic before.

 

Tranks in advance

Labels (4)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

can you check your regex used to extract url once ?

apply same regex using rex command to see if that is working or not.

————————————
If this helps, give a like below.

user2020dy
Path Finder

yes, the search works fine, but if I add this rex to extract a field "URL" in datamodel, the new  field doesn`t appear

user2020dy_0-1601888232391.png

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...