Splunk Search

How to extract second field between quotes and add url?

Mick_OBrien
Path Finder

I have logs of the format...

2022-09-07T01:42:06.321624+00:00 micro.service 2867ce23-bdfd-48eb-ba5a-40e1e8a93987[[APP/PROC/WEB/0]] 159.203.190.66, 100.64.144.3 - - - [07/Sep/2022:01:42:06 +0000] "GET url HTTP/1.1" 404 125

...and I want to extract a count of missing URLs by microservice.  I can get a count of microservice using...

index=myIndex "404 125" | rex "^\S+\s(?<microService>\S+).*" | bucket _time span=day | stats count by microService

...but I would like to know how to add the url

Any help appreciated

 

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Mick_OBrien,

ok, please try this:

| rex "^\S+\s(?<microService>\S+).*.\"GET\s+(?<url>[^ ]+)"

that you  can test at https://regex101.com/r/HFgP6J/2

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Mick_OBrien,

let me understand: in your sample you want to extract: "micro.service" and "APP/PROC/WEB/0", is it correct?

If this is your need, please try this:

| rex "^\S+\s(?<microService>\S+).*.\[\[(?<url>[^\]]+)"

that you can test at https://regex101.com/r/HFgP6J/1

Ciao.

Giuseppe

0 Karma

Mick_OBrien
Path Finder

Hi @gcusello 

Thanks for reply but I want to extract the url after the GET 

Mick

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mick_OBrien,

ok, please try this:

| rex "^\S+\s(?<microService>\S+).*.\"GET\s+(?<url>[^ ]+)"

that you  can test at https://regex101.com/r/HFgP6J/2

Ciao.

Giuseppe

Mick_OBrien
Path Finder

@gcusello 

Thanks - that seems to be working!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mick_OBrien,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated :winking_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...