Splunk Search

How to extract id from url message?

Span
Engager

Hi, I have below message and Iam trying to use rex to extract the id... But myid always shows empty.. Please help


- - [02/Nov/2022:17:43:03 -0400] "PUT /application/resources/cat/v7/product/1234567890003/status HTTP/1.1" 201 - abcd.com - 8 web-614

 

rex field=msg "/application/resources/cat/v7/product/(?<myid>[0-9]*)/status" | table myid

 

Labels (1)
0 Karma
1 Solution

johnhuang
Motivator

The sample data looks like _raw rather than msg.

You can try something like this which extracts any 13 digit number nested between forward slashes. This could be more flexible depending on the variability of your data. 

| rex "\/(?<myid>\d{13})\/"
| table myid

 

View solution in original post

johnhuang
Motivator

The sample data looks like _raw rather than msg.

You can try something like this which extracts any 13 digit number nested between forward slashes. This could be more flexible depending on the variability of your data. 

| rex "\/(?<myid>\d{13})\/"
| table myid

 

richgalloway
SplunkTrust
SplunkTrust

Slashes in regular expressions must be escaped.

rex field=msg "\/application\/resources\/cat\/v7\/product\/(?<myid>[0-9]*)/status" | table myid
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...