I'm Trying to run a table on IIS logs. The farm is https://sp001, examples below)... However, within the farm we have individual sites. I would like to be able to extract the site name, like "Access%20Requests KYCOpsSupportDocuments" etc... , to table:
https://sp004.mydomain.net/sites1/spvfvfst/Access%20Requests/pendingreq.aspx...
https://sp004.mydomain.net/sites1/spvfvfst/KYCOpsSupportDocuments/...
https://sp004.mydomain.net/sites1/spvfvfst/KYCOpsSupportDocuments/...
https://sp004.mydomain.net/sites1/spvfvfst/Blah/LOB%20Es...
https://sp004.mydomain.net/sites1/spvfvfst/_vti_bin/LOB%20Escalation..
https://sp004.mydomain.net/sites1/spvfvfst/12345dddd/LOB%20Escalation3bivey%25252C%252520Sara&Conten......
https://sp004.mydomain.net/sites1/spvfvfst/Lists/LOB%20Escalation8B...
Thanks!
Hi @smudge797, Try this
your base search | rex field=_raw max_match=0 "spvfvfst\/(?<site_name>\S+)\/"
hi @smudge797
try this query
| rex field=<fieldname> "/spvfvfst/(?<MyField>[^,\s]+)/"
@smudge797, Try this:
...|rex field=<fieldname> "https:\/\/([^\/]+\/){3}(?<sites>[^\/]+)"
try this run anywhere search-
| makeresults |eval a="https://sp004.mydomain.net/sites1/spvfvfst/Access%20Requests/pendingreq.aspx..."|rex field=a "https:\/\/([^\/]+\/){3}(?<sites>[^\/]+)"