Splunk Search

How do I extract farm name from IIS logs to a table?

smudge797
Path Finder
0 Karma

imthesplunker
Path Finder

Hi @smudge797, Try this

your base search | rex field=_raw max_match=0 "spvfvfst\/(?<site_name>\S+)\/"
0 Karma

harishalipaka
Builder

hi @smudge797

try this query

 | rex field=<fieldname> "/spvfvfst/(?<MyField>[^,\s]+)/"
0 Karma

493669
Super Champion

@smudge797, Try this:

...|rex field=<fieldname> "https:\/\/([^\/]+\/){3}(?<sites>[^\/]+)"

try this run anywhere search-

| makeresults |eval a="https://sp004.mydomain.net/sites1/spvfvfst/Access%20Requests/pendingreq.aspx..."|rex field=a "https:\/\/([^\/]+\/){3}(?<sites>[^\/]+)"
0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on