Splunk Search

Extract field after text

ashvini_mishra
Explorer

Here is log example - 

http://host/manager/resource_identifier/ids/getOrCreate/bulk?dscid=LuSxrA-1c42bb5b-f862-4861-892f-69320e1a59e7:200 Created:78

I need to extract string after ids/ untill first ? or : 

So output would be - getOrCreate/bulk

I am trying this - 

rex field=log ":(?<url>ids\/[^?: ]*)"

 

What am I missing?

Labels (2)
0 Karma
1 Solution

danielcj
Path Finder

Hello,

Please, try the following:

| rex field=log "ids\/(?<url>[^\?|\:]+)"

 

If your "log" field is not presenting the log example that you used, you can try substitute field=log to field=_raw

View solution in original post

ashvini_mishra
Explorer

@danielcj  @ashvinpandey  

Thank for your responses, this works - 

I saw some of my logs don't have "ids/" in them, in that case url turns out to be blank. Here how  can I perform an OR operation to calculate url as -   rex field=log "com\/(?<url>[^\?|\:\/ ]+)"

That is - 

if  -  "ids\/(?P<url>[^?:\s]+)" return blank then extract url as -  "com\/(?<url>[^\?|\:\/ ]+)"

0 Karma

ashvinpandey
Communicator

@ashvini_mishra Try this:

| rex field=_raw "ids\/(?P<url>.*?)\?"

 

if this is some fieldname then just replace _raw by your fieldname, or use the below rex:

 

| rex field=log "ids\/(?P<url>.*?)\?"

 

Also, If this reply helps you, an upvote would be appreciated.

danielcj
Path Finder

Hello,

Please, try the following:

| rex field=log "ids\/(?<url>[^\?|\:]+)"

 

If your "log" field is not presenting the log example that you used, you can try substitute field=log to field=_raw

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!