Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Help with Regex
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
With my virtually non existent skills around regex I am struggling to get an extraction to work 😞
I am trying to extract some text after the third / as per the below
[http://10.91.11.47:1200/WMB_SAFIRE_INT/BCSWebservice/services/ProcessQuoteMB]
The text I want to extract is everything after the 3rd / so WMB_SAFIRE_INT/BCSWebservice/services/ProcessQuoteMB (the text content & length can vary but the start and end point of the text is consistent in that it starts with [http:// and ends with ]).
The result is then piped to a field(?) called WS (?)
Any help or pointers would be very much appreciated
Cheers,
Alastair
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Very rough attempt below. It should create a new field called WS, but it is specifially setup for 2 digit ip, you can change that to suit your setup
rex field=fieldname "\[http\:\/\/[0-9]{2}\.[0-9]{2}\.[0-9]{2}\.[0-9]{2}\:[0-9]{4}\/(?<WS>\S+)*\]"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Very rough attempt below. It should create a new field called WS, but it is specifially setup for 2 digit ip, you can change that to suit your setup
rex field=fieldname "\[http\:\/\/[0-9]{2}\.[0-9]{2}\.[0-9]{2}\.[0-9]{2}\:[0-9]{4}\/(?<WS>\S+)*\]"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Fantastic.. works a treat. Thank you so much.
Cheers,
Alastair
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Alastair,
You should use the following regex for your field due to the fact that IP's can be 3 digit.
rex field=fieldname "\[http\:\/\/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\:[0-9]+\/(?<WS>\S+)*\]"
The + quantifier in essence says Any amount of any number in the range of 0 - 9
This should work, I haven't had a chance to test it, but I'm pretty sure it would work.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Mile High Learning with Splunk University, Denver, Colorado
IT Service Intelligence 5.0 Series: Your Guide to the June Launch
Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0
