Splunk Search

How to List records where a field contains a specific string?

nlxtasy69
Engager

I have an index: an_index , there's a field with URLs - URL/folder/folder   I only want to list the records that contain a specific URL.  I don't care about anything after the URL.  I just want to match the URL

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| regex Field_x="^https:\/\/xyz\.com\/"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Strictly speaking, URLs can include folders. What do you mean by URL?

0 Karma

nlxtasy69
Engager

For example:

Field_x = https://xyz.com/folder_a/folder_b

Field_x = https://abc.com/folder_x

 

I want to only list the records where Field_x contains https://xyz.com

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @nlxtasy69,

did you tried something like this?

index=an_index
| rex "^(?<URL>https:\/\/xyz\.com"
| stats count BY URL

Ciao.

Giuseppe

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| regex Field_x="^https:\/\/xyz\.com\/"
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...