Help in Regex

[aditsss]

Hi Team,

I have one requirement :

I have multiple URL'S some contain id and some dont contain id's

URL'S Example

https://opu/api/processs/3fe13d52-d326-15a1-acef-ed3395edd973/registry(with ID)

https://POI/api/processors/022adcc6-8001-3d7a-b291-3d0831458357(with ID)

https://uyt/api/flow/config (WITHOUT ID)

Like this there are more multiple URL's

MY id pattern is this in URL's: 05ee3b30-d5e1-1977-9aa9-61c458568edb

So I have made regex like this:

^.*([A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})$

Can someone help me out with complete regex . How can I put this (^.*([A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})$) in one column which only contain id's using regex.

[aditsss]

Hi,

I am able to get one new column ID which contains the ID from Request_URL

But not able to get the records which does not include ID like

https://abc/api/flow/prioritizers

https://poi/api/flow/controller-service-types

https://liu/api/flow/groups/root

I want these records should also be display and ID column should be blank for them.

Can someone guide me.

[aditsss]

Hi, I am able to get one new column ID which contains the ID from Request_URL But not able to get the records which does not include ID like

https://abc/api/flow/prioritizers

https://poi/api/flow/controller-service-types

https://liu/api/flow/groups/root

I want these records should also be display and ID column should be blank for them.

Can someone guide me.

Its really required.

Thanks in advance

[ITWhisperer · Accepted solution]

Already answered here https://community.splunk.com/t5/Splunk-Search/How-to-extract-portion-of-the-string-using-Regex/td-p/...

[aditsss]

Thank u so much ITWhisperer for all your guidance.

[richgalloway]

If I understand the question correctly then this search should extract the ID from those URLs that have them.

index=foo URL*
| rex field=URL "(?<ID>[A_Za-z0-9]{8}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{4}[\-][A_Za-z0-9]{12})"