Splunk Search

How to Extract a Part of the field in splunk

Engager

Hi Everyone,

It would be great if someone help me on this.

I am having one field URL in my raw data.

URL = https://jfghdw.ind.com:1001/xyz/flow/group/186yugh-w12-567c-b89-pghj67y

Now I want to extract only the last portion(that will be different for each URL so Cant take hard coded value) of the field URL 

How to extract the 6th portion of the field that is "186yugh-w12-567c-b89-pghj67y" (It will be different for each URL)

using regular expression.

 

Labels (3)

Engager

Hi Chavi, 

Is the URL always going to be the same?

If that is the case you could use the following: regular expression:

 

snippet.PNG

If the URL is dynamic in each event then its probably best to use a multi value eval function like mvindex:

Capture.PNG

 

If you have any more question do not hesitate to respond.

Best regards, 

bquirin

0 Karma

SplunkTrust
SplunkTrust

| eval result=mvindex(split(URL,"/"),-1)

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!