How to extract data at specific position from url?

[marcosjags]

Hello Everyone, 

I am new to splunk. I am searching the logs and I am getting my url like this /api/sns/exts/djs/310200019110274535/ds/310200019110274536/. What I want here is i want to extract the djs data which is 310200019110274535 in this case. Any help would be appreciated.

[gcusello]

Hi @marcosjags,

if the string to extract is always in the seventh position in the url, you can use something lie this:

| rex "^(\/\w+){6}\/(?<djs>\d+)"

that you can test at https://regex101.com/r/HvJFCS/1

if instead after the string to extract there's always "/.", you can use this regex

| rex "(?<djs>\d+)\/\."

Ciao.

Giuseppe

[marcosjags]

@gcusello How can i show that in the table next to url like this

/api/sns/exts/djs/310200019110274535/ds/310200019110274536/  310200019110274535

do I have to hold this in a variable and then should I do 

table url variable

[gcusello · Accepted solution]

Hi @marcosjags,

you should try something like this:

index=your_index
| rex field=url "^(\/\w+){6}\/(?<variable>\d+)"
| table url variable

If you need also to extract url field, you should share some sample of your logs.

My hint is to follow the Splunk Search Tutorial (https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial/WelcometotheSearchTutorial)  to know how to use Splunk commands.

Ciao.

Giuseppe

[gcusello]

Hi @marcosjags,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉

[marcosjags]

Thanks for the help @gcusello . I will surely check the documentation

[ITWhisperer]

Or if it always follows "/djs/"

| rex "\/djs\/(?<djs>\d+)\/"

The main thing is that you need to determine the pattern in the URL which helps you anchor where to find the data you are looking for.