Splunk Search

Extract from URL

smahuja
Explorer

Hi,

 

I have following kind of url :

  1. https://abc.com/loc/country/123/iss
  2. https://abc.com/a1/v1/country/456.json?returnFields=attr,add
  3. https://abc.com/a1/countries/456/av/int/orig/curr

I want to extract numbers(123,456) , in url whatever comes after country / countries , want that digit.

Thanks in advance

Thanks,

 

Labels (1)
0 Karma

spitchika
Path Finder

This works for you...

| makeresults
| eval value="https://abc.com/a1/countries/456/av/int/orig/curr"
| rex field=value "coun\D+(?<Num_value>\d+)"
| stats values(Num_value)

0 Karma
Get Updates on the Splunk Community!

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk &#43; Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...

Data Management Digest – January 2026

Welcome to the January 2026 edition of Data Management Digest! Welcome to the January 2026 edition of Data ...