How do I extract farm name from IIS logs to a table?

[smudge797]

I'm Trying to run a table on IIS logs. The farm is https://sp001, examples below)... However, within the farm we have individual sites. I would like to be able to extract the site name, like "Access%20Requests KYCOpsSupportDocuments" etc... , to table:

https://sp004.mydomain.net/sites1/spvfvfst/Access%20Requests/pendingreq.aspx...
https://sp004.mydomain.net/sites1/spvfvfst/KYCOpsSupportDocuments/...
https://sp004.mydomain.net/sites1/spvfvfst/KYCOpsSupportDocuments/...
https://sp004.mydomain.net/sites1/spvfvfst/Blah/LOB%20Es...
https://sp004.mydomain.net/sites1/spvfvfst/_vti_bin/LOB%20Escalation..
https://sp004.mydomain.net/sites1/spvfvfst/12345dddd/LOB%20Escalation3bivey%25252C%252520Sara&Conten......
https://sp004.mydomain.net/sites1/spvfvfst/Lists/LOB%20Escalation8B...

Thanks!

[imthesplunker]

Hi @smudge797, Try this

your base search | rex field=_raw max_match=0 "spvfvfst\/(?<site_name>\S+)\/"

[harishalipaka]

hi @smudge797

try this query

 | rex field=<fieldname> "/spvfvfst/(?<MyField>[^,\s]+)/"

[493669]

@smudge797, Try this:

...|rex field=<fieldname> "https:\/\/([^\/]+\/){3}(?<sites>[^\/]+)"

try this run anywhere search-

| makeresults |eval a="https://sp004.mydomain.net/sites1/spvfvfst/Access%20Requests/pendingreq.aspx..."|rex field=a "https:\/\/([^\/]+\/){3}(?<sites>[^\/]+)"