Splunk Search

Extracting port number from url field

lauMarot
Path Finder

Hello,

Suppose I've got the following url among lot of others : (logs come from something close to Squid but not indexed properly by Splunk)

nav.smartscreen.microsoft.com:443
https://www.francebleu.fr/img/antenne.svg
http://frplab.com:37566/sdhjkzui1782109zkjeznds

http://192.168.120.25:25
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_175%2Cw_300%2Cc_fill%2Cg_faces:aut...

I wish I could extract the port number when ther is one. I saw a lot a similar cases on Splunk Answers but the url formating was less varaible than mine.

The only way to achieve my aim was to use the following SPL:


index=* sourcetype=syslog | rex field=url "(http|https)?[^\:]+\:(?<port>[^\/]+)" | eval monport = if(isint(port), port, 0) | top monport

Is there a more elegant way to to ?

Labels (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

you could try this

| makeresults
| eval _raw="nav.smartscreen.microsoft.com:443
https://www.francebleu.fr/img/antenne.svg
http://frplab.com:37566/sdhjkzui1782109zkjeznds
http://192.168.120.25:25
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_175%2Cw_300%2Cc_fill%2Cg_faces:aut..."
| multikv noheader=t
```Above generates sample data```
| rex "((?<proto>http[s]?):\/\/)?(?<url>[^:\/]*)(:(?<port>\d+))?"
| table proto url port _raw

r. Ismo 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

you could try this

| makeresults
| eval _raw="nav.smartscreen.microsoft.com:443
https://www.francebleu.fr/img/antenne.svg
http://frplab.com:37566/sdhjkzui1782109zkjeznds
http://192.168.120.25:25
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_175%2Cw_300%2Cc_fill%2Cg_faces:aut..."
| multikv noheader=t
```Above generates sample data```
| rex "((?<proto>http[s]?):\/\/)?(?<url>[^:\/]*)(:(?<port>\d+))?"
| table proto url port _raw

r. Ismo 

Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...