Splunk Search

Extracting port number from url field

lauMarot
Path Finder

Hello,

Suppose I've got the following url among lot of others : (logs come from something close to Squid but not indexed properly by Splunk)

nav.smartscreen.microsoft.com:443
https://www.francebleu.fr/img/antenne.svg
http://frplab.com:37566/sdhjkzui1782109zkjeznds

http://192.168.120.25:25
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_175%2Cw_300%2Cc_fill%2Cg_faces:aut...

I wish I could extract the port number when ther is one. I saw a lot a similar cases on Splunk Answers but the url formating was less varaible than mine.

The only way to achieve my aim was to use the following SPL:


index=* sourcetype=syslog | rex field=url "(http|https)?[^\:]+\:(?<port>[^\/]+)" | eval monport = if(isint(port), port, 0) | top monport

Is there a more elegant way to to ?

Labels (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

you could try this

| makeresults
| eval _raw="nav.smartscreen.microsoft.com:443
https://www.francebleu.fr/img/antenne.svg
http://frplab.com:37566/sdhjkzui1782109zkjeznds
http://192.168.120.25:25
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_175%2Cw_300%2Cc_fill%2Cg_faces:aut..."
| multikv noheader=t
```Above generates sample data```
| rex "((?<proto>http[s]?):\/\/)?(?<url>[^:\/]*)(:(?<port>\d+))?"
| table proto url port _raw

r. Ismo 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

you could try this

| makeresults
| eval _raw="nav.smartscreen.microsoft.com:443
https://www.francebleu.fr/img/antenne.svg
http://frplab.com:37566/sdhjkzui1782109zkjeznds
http://192.168.120.25:25
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_175%2Cw_300%2Cc_fill%2Cg_faces:aut..."
| multikv noheader=t
```Above generates sample data```
| rex "((?<proto>http[s]?):\/\/)?(?<url>[^:\/]*)(:(?<port>\d+))?"
| table proto url port _raw

r. Ismo 

Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...