Splunk Search

How to extract second field between quotes and add url?

Mick_OBrien
Path Finder

I have logs of the format...

2022-09-07T01:42:06.321624+00:00 micro.service 2867ce23-bdfd-48eb-ba5a-40e1e8a93987[[APP/PROC/WEB/0]] 159.203.190.66, 100.64.144.3 - - - [07/Sep/2022:01:42:06 +0000] "GET url HTTP/1.1" 404 125

...and I want to extract a count of missing URLs by microservice.  I can get a count of microservice using...

index=myIndex "404 125" | rex "^\S+\s(?<microService>\S+).*" | bucket _time span=day | stats count by microService

...but I would like to know how to add the url

Any help appreciated

 

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Mick_OBrien,

ok, please try this:

| rex "^\S+\s(?<microService>\S+).*.\"GET\s+(?<url>[^ ]+)"

that you  can test at https://regex101.com/r/HFgP6J/2

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Mick_OBrien,

let me understand: in your sample you want to extract: "micro.service" and "APP/PROC/WEB/0", is it correct?

If this is your need, please try this:

| rex "^\S+\s(?<microService>\S+).*.\[\[(?<url>[^\]]+)"

that you can test at https://regex101.com/r/HFgP6J/1

Ciao.

Giuseppe

0 Karma

Mick_OBrien
Path Finder

Hi @gcusello 

Thanks for reply but I want to extract the url after the GET 

Mick

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mick_OBrien,

ok, please try this:

| rex "^\S+\s(?<microService>\S+).*.\"GET\s+(?<url>[^ ]+)"

that you  can test at https://regex101.com/r/HFgP6J/2

Ciao.

Giuseppe

Mick_OBrien
Path Finder

@gcusello 

Thanks - that seems to be working!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mick_OBrien,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...