Splunk Search

How to edit my regular expression to extract URI from URL?

xxdesmus
Explorer

Hey folks, sorry for asking this type of regex question yet again.

I have values like this in a field called "url":

http://8.8.8.8/file.sh
http://1.1.1.1/file2.sh
http://8.8.4.4/file3.sh

I'm trying to use rex to grab just the URI following the last " / " so I end up with a list like this:

file.sh
file2.sh
file3.sh

I was trying to accomplish this using source=cowrie url=* | rex field=uri "\/(?<url>\w+)\s" | table uri but I'm 99% sure my regular expression is wrong.

Any help would be greatly appreciated!

0 Karma
1 Solution

somesoni2
Revered Legend

Give these a try (remove head command after testing)

source=cowrie url=* | head 100 | table url| rex field=url "\/(?<uri>\w+\.\w+)$" 

OR

source=cowrie url=* | head 100 | table url| rex field=url "^\w+:\/\/[^\/]+\/(?<uri>.+)$" 

View solution in original post

somesoni2
Revered Legend

Give these a try (remove head command after testing)

source=cowrie url=* | head 100 | table url| rex field=url "\/(?<uri>\w+\.\w+)$" 

OR

source=cowrie url=* | head 100 | table url| rex field=url "^\w+:\/\/[^\/]+\/(?<uri>.+)$" 

xxdesmus
Explorer

You are a genius. Thanks!

Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...