Splunk Search

Help to extract fields from the URL

maria_n
Explorer

I need to extract "internal-blue-ocf" as namespace and "stress-b.aps.gc1-b.lle.ocf.xxx.com" as service using rex from the below data.
The condition for the fields should be like,
1) namespace: content between http:// and -oic
2) service: content should start after oic- and ends at .com

MESSAGE: 2019-12-05 04:04:42, Environment=OIC STRESS B, Service=, Status=000, Response_Time=0.000, Endpoint=http://internal-blue-ocf-oic-stress-b.aps.gc1-b.lle.ocf.xxx.com/oic/

The rex should be used on field called MESSAGE. Please help!

0 Karma
1 Solution

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval MESSAGE="MESSAGE: 2019-12-05 04:04:42, Environment=OIC STRESS B, Service=, Status=000, Response_Time=0.000, Endpoint=http://internal-blue-ocf-oic-stress-b.aps.gc1-b.lle.ocf.xxx.com/oic/" 
| rex field=MESSAGE "Endpoint=http:\/\/(?P<namespace>.+)-oic-(?P<service>.+.com)"

View solution in original post

maria_n
Explorer

Thanks @vnravikumar and @kamlesh_vaghela. It worked 🙂

0 Karma

kartm2020
Communicator

Please try the below
| rex field=_raw "http:..(?P\w+-\w+-\w+)-oic-(?P.*.com)"

If the data look likes above, this regex will work. But the data contains numbers in between word. We need to write different regex.
Kindly let me know if it works.

0 Karma

maria_n
Explorer

Sorry, this didn't work @kartm. The above ones shared by kamlesh and ravikumar worked for me. Thanks anyway 🙂

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@maria_n

Can you please try this?

YOUR_SEARCH | rex field=MESSAGE " Endpoint=http:\/\/(?<namespace>.*)-oic-(?<service>.*\.com)" 
| table namespace service MESSAGE

Sample:

| makeresults 
| eval MESSAGE="MESSAGE: 2019-12-05 04:04:42, Environment=OIC STRESS B, Service=, Status=000, Response_Time=0.000, Endpoint=http://internal-blue-ocf-oic-stress-b.aps.gc1-b.lle.ocf.xxx.com/oic/" 
| rex field=MESSAGE " Endpoint=http:\/\/(?<namespace>.*)-oic-(?<service>.*\.com)" 
| table namespace service MESSAGE

Thanks

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval MESSAGE="MESSAGE: 2019-12-05 04:04:42, Environment=OIC STRESS B, Service=, Status=000, Response_Time=0.000, Endpoint=http://internal-blue-ocf-oic-stress-b.aps.gc1-b.lle.ocf.xxx.com/oic/" 
| rex field=MESSAGE "Endpoint=http:\/\/(?P<namespace>.+)-oic-(?P<service>.+.com)"
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...