Splunk Search

Extract the User-Agent from HTTP request

ashishmgupta
Explorer

Below the excerpt from my HTTP request and I'm trying to get the User-Agent value from it and so far not successful. Will appreciate any help.

This Splunk editor is removing the carriage return and line feed characters so below is the regex101 link.https://regex101.com/r/rdu8yE/1

Also attached is the screenshot of the HTTP request.

 

 

Labels (2)
0 Karma
1 Solution

ashishmgupta
Explorer

looks like 4 backslashes to get two? Below worked. Thank you for your help. 

User-Agent: (?<UserAgent>[^\\\\]*)

View solution in original post

0 Karma

ashishmgupta
Explorer

looks like 4 backslashes to get two? Below worked. Thank you for your help. 

User-Agent: (?<UserAgent>[^\\\\]*)

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your regex was very close.  This worked for me using the one example:

User-Agent: (?<UserAgent>[^\\]*)
---
If this reply helps you, Karma would be appreciated.

ashishmgupta
Explorer

Error in 'rex' command: Encountered the following error while compiling the regex 'User-Agent: (?<UserAgent>[^\]*)': Regex: missing terminating ] for character class.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

To use backslashes in a regex in SPL you have to escape them.

User-Agent: (?<UserAgent>[^\\\\\\]*)

Yes, that's 6 backslashes to get two.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...