Splunk Search

How to extract a text from a field

nirmalya2006
Path Finder

Hi All

I have a field which has urls in this pattern

GET /echo/index?page=content&id=PRO19579&viewlocale=es_ES HTTP/1.1  
GET /echo/index?page=relatedLinks&id=PRD1296&viewLocale=null&channel=REFERENCE&_=1454507716347 HTTP/1.1

I have to extract only the part between 'page' and '&' ie 'content' and 'relatedLinks' from it.
I tried to extract it using substr and rtrim but I am unable to trim contents after &.
My search string is

| eval URL = substr(field7,17) | eval URL = rtrim(URL,"^\\&.*") 

After using substr my result is

page=content&id=PRO19579&viewlocale=es_ES HTTP/1.1
page=relatedLinks&id=PRD1296&viewLocale=null&channel=REFERENCE&_=1454507716347 HTTP/1.1

But the rtrim function is not at all working to remove the text with and after &.

Please help.

0 Karma
1 Solution

sundareshr
Legend

Use rex instead

... | rex "page=(?<page>[^&]+)" | table page

View solution in original post

sundareshr
Legend

Use rex instead

... | rex "page=(?<page>[^&]+)" | table page
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...