Splunk Search

How to extract a text from a field

nirmalya2006
Path Finder

Hi All

I have a field which has urls in this pattern

GET /echo/index?page=content&id=PRO19579&viewlocale=es_ES HTTP/1.1  
GET /echo/index?page=relatedLinks&id=PRD1296&viewLocale=null&channel=REFERENCE&_=1454507716347 HTTP/1.1

I have to extract only the part between 'page' and '&' ie 'content' and 'relatedLinks' from it.
I tried to extract it using substr and rtrim but I am unable to trim contents after &.
My search string is

| eval URL = substr(field7,17) | eval URL = rtrim(URL,"^\\&.*") 

After using substr my result is

page=content&id=PRO19579&viewlocale=es_ES HTTP/1.1
page=relatedLinks&id=PRD1296&viewLocale=null&channel=REFERENCE&_=1454507716347 HTTP/1.1

But the rtrim function is not at all working to remove the text with and after &.

Please help.

0 Karma
1 Solution

sundareshr
Legend

Use rex instead

... | rex "page=(?<page>[^&]+)" | table page

View solution in original post

sundareshr
Legend

Use rex instead

... | rex "page=(?<page>[^&]+)" | table page
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...