AL9851 | Z1 | [https://example1.com/] recording played asia location is Down
AL9851 | Z1 | [http://alphabeta/] recording played from asia location is Down
AL9851 | Z1 | [http://alphabeta/] recording played from US location is Down
i have above log from that need to extract URL .as URL varies but content is same before and after URL .
Hi @sekhar463
the phrase from @bowesmana means that using the rex command you can extract a field from the entire raw log (without specifying any field) as in your case, or specifying a field.
Ciao.
Giuseppe
thanks it works
but is both rex works as same
| rex "^([^\|]+\|\s+){2}\[(?<URL>[^\]]+)\]"
| rex "\[(?<url>http[^\]]*)\]"
Thanks it works
but what is it means parsing _raw field
Hi @sekhar463
the phrase from @bowesmana means that using the rex command you can extract a field from the entire raw log (without specifying any field) as in your case, or specifying a field.
Ciao.
Giuseppe
Thank you
Hi @sekhar463,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated by all the contributors 😉
you could try this:
| rex "^([^\|]+\|\s+){2}\[(?<URL>[^\]]+)\]"
that you can test at https://regex101.com/r/2HDtmM/1
Ciao.
Giuseppe
thanks
that works
Use
| rex "\[(?<url>http[^\]]*)\]"
assuming you are parsing _raw field
I am assuming your example has 3 rows with 3 urls. The field name extracted above will be url