I have logs having string like:
127.0.0.1|> GET /alldata
127.0.0.1|> GET /somedata
127.0.0.1|> GET /nodata
127.0.0.1|> POST /nodata
127.0.0.1|> PUT /nodata
127.0.0.1|> DELETE /nodata
I want to extract the field between 127.0.0.1|> and /
i.e i need GET,POST,PUT,DELETE to be in an extracted field.
NOTE: There's a space after > and before /
Hi @rohanmiskin
Try this and let me know
| makeresults
| eval sampledata ="127.0.0.1|> GET /somedata"
| rex field="sampledata" ">\s(?P<method>.*)\s\/"
@rohanmiskin ,
Try
"\>\s(?<ACTION>\w+)"