Splunk Search

How do I extract a field between two strings using a regular expression?

Explorer

I have logs having string like:

127.0.0.1|> GET /alldata
127.0.0.1|> GET /somedata
127.0.0.1|> GET /nodata
127.0.0.1|> POST /nodata
127.0.0.1|> PUT /nodata
127.0.0.1|> DELETE /nodata

I want to extract the field between 127.0.0.1|> and /
i.e i need GET,POST,PUT,DELETE to be in an extracted field.

NOTE: There's a space after > and before /

0 Karma

Champion

Hi @rohanmiskin

Try this and let me know

| makeresults 
| eval sampledata ="127.0.0.1|> GET /somedata" 
| rex field="sampledata" ">\s(?P<method>.*)\s\/"
0 Karma

SplunkTrust
SplunkTrust

@rohanmiskin ,

Try

"\>\s(?<ACTION>\w+)"