How to extract portion of the string using Regex

[aditsss]

Hi Eveyone,

Can anyone help me out in this.

I have a field name    Request_URL as = https://xyz/api/groups/230df08c/registry.

I want to extarct "230df08c" portion from every Request_URL .

Can someone guide me with the regular expression of it in splunk

Thanks In advance

[to4kawa]

(?J)(\/api\/\w+\/(?<id>\w+))|(\/groups\/(?<id>\w+))|(\/com\/(?<id>\w+))

REGEX must be made to match the exact log.
It is impossible to create a reliable one if you are not presented with the correct sample.

[yeahnah]

Hi @aditsss 

Based on your examples, the following will work for you.

...| rex field=Request_URL "([^\r\n\/]*\/){4,5}(connections|groups|services|processors)\/(?<id>[^\r\n\/]+)"

 If you need to alter this further, or understand what the regex code is doing, then I suggest a site like regex101 (https://regex101.com/) as a useful place to test and learn about regex code.

Hope this helps.

[aditsss]

Hey,

I cant hard coded the words 

connections|groups|services|processors

These are some of the examples I have given of the Request_URL

https://uyz/api/flow/controller-service-types 

There are certain URL's which are of these types(as shown above). If I will hardcode the word then they will not come. I want to display the whole data . The REQUEST_URL which contain the id should display id otherwise blank.

[gcusello]

Hi @aditsss,

to extract a regex, you have to find a rule: position, format, near words, or a combination of them, otherwise it isn't possible to extract the word you need.

Ciao.

Giuseppe

[aditsss]

Hi,

I will follow this approch

rex field=Request_URL "([^\r\n\/]*\/){4,5}(connections|groups|services|processors)\/(?<id>[^\r\n\/]+)"

But there are certain URL's which also have index at 3,6,7,8

https://apz/api/queues/61c458568edb/flowfiles/content /regisrtry

https://tyu/policies/read/groups/4e25daf4d5d6/var

https://com/6547890e/

Can u give me complete regex with all indexes as {3,4,5,6,7,8} to extract id.

[aditsss]

Please guide me on that .

[aditsss]

Hi,

Can someone please provide me the complete regex for {3,4,5,6,7,8} as well.

Below regex will going to work for me. Please provide me for {3,4,5,6,7,8} currently I am getting records only which have{4,5} from below regex.

 rex field=Request_URL "([^\r\n\/]*\/){4,5}(connections|groups|services|processors)\/(?<id>[^\r\n\/]+)"

 Please provide me complete regex.