Splunk Search

Extract field after text

ashvini_mishra
Explorer

Here is log example - 

http://host/manager/resource_identifier/ids/getOrCreate/bulk?dscid=LuSxrA-1c42bb5b-f862-4861-892f-69320e1a59e7:200 Created:78

I need to extract string after ids/ untill first ? or : 

So output would be - getOrCreate/bulk

I am trying this - 

rex field=log ":(?<url>ids\/[^?: ]*)"

 

What am I missing?

Labels (2)
0 Karma
1 Solution

danielcj
Communicator

Hello,

Please, try the following:

| rex field=log "ids\/(?<url>[^\?|\:]+)"

 

If your "log" field is not presenting the log example that you used, you can try substitute field=log to field=_raw

View solution in original post

ashvini_mishra
Explorer

@danielcj  @ashvinpandey  

Thank for your responses, this works - 

I saw some of my logs don't have "ids/" in them, in that case url turns out to be blank. Here how  can I perform an OR operation to calculate url as -   rex field=log "com\/(?<url>[^\?|\:\/ ]+)"

That is - 

if  -  "ids\/(?P<url>[^?:\s]+)" return blank then extract url as -  "com\/(?<url>[^\?|\:\/ ]+)"

0 Karma

ashvinpandey
Contributor

@ashvini_mishra Try this:

| rex field=_raw "ids\/(?P<url>.*?)\?"

 

if this is some fieldname then just replace _raw by your fieldname, or use the below rex:

 

| rex field=log "ids\/(?P<url>.*?)\?"

 

Also, If this reply helps you, an upvote would be appreciated.

danielcj
Communicator

Hello,

Please, try the following:

| rex field=log "ids\/(?<url>[^\?|\:]+)"

 

If your "log" field is not presenting the log example that you used, you can try substitute field=log to field=_raw

Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...