Hi team, i need to extract the locale field in BOLD , can you help me with it

[Hemant1]

/en_sek/klarna

[paulbannister]

Hi There,

\/(?P<locale>[^\/]+)\/klarna

Or within the Splunk search itself:

|rex field= ##INSERT RELEVANT FIELDNAME## "\/(?P<locale>[^\/]+)\/klarna"

[paulbannister]

Hi There,

If you mean via REGEX then try the following:

\.com\/(?P<locale>[^\/]+)\/

Or within the Splunk search itself:

|rex field=_raw "\.com\/(?P<locale>[^\/]+)\/"

EDIT:
Slightly improved regex to incorporate address such as ".co.uk":

((\.\w{2,3}\.\w{2,3})|\.\w{2,3})\/(?P<locale>[^\/]+)\/

or

|rex field=_raw "((\.\w{2,3}\.\w{2,3})|\.\w{2,3})\/(?P<locale>[^\/]+)\/"