Splunk Search

How to edit my regular expression to extract URI from URL?

xxdesmus
Explorer

Hey folks, sorry for asking this type of regex question yet again.

I have values like this in a field called "url":

http://8.8.8.8/file.sh
http://1.1.1.1/file2.sh
http://8.8.4.4/file3.sh

I'm trying to use rex to grab just the URI following the last " / " so I end up with a list like this:

file.sh
file2.sh
file3.sh

I was trying to accomplish this using source=cowrie url=* | rex field=uri "\/(?<url>\w+)\s" | table uri but I'm 99% sure my regular expression is wrong.

Any help would be greatly appreciated!

0 Karma
1 Solution

somesoni2
Revered Legend

Give these a try (remove head command after testing)

source=cowrie url=* | head 100 | table url| rex field=url "\/(?<uri>\w+\.\w+)$" 

OR

source=cowrie url=* | head 100 | table url| rex field=url "^\w+:\/\/[^\/]+\/(?<uri>.+)$" 

View solution in original post

somesoni2
Revered Legend

Give these a try (remove head command after testing)

source=cowrie url=* | head 100 | table url| rex field=url "\/(?<uri>\w+\.\w+)$" 

OR

source=cowrie url=* | head 100 | table url| rex field=url "^\w+:\/\/[^\/]+\/(?<uri>.+)$" 

xxdesmus
Explorer

You are a genius. Thanks!

Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...