Splunk Search

How to return a url only to the 2nd slash?

isxtn
Explorer

So, this PCRE regex works in testers, but not on Splunk. 

 

^((http[s]?):\/)?\/?([^:\/\s]+)((\w+)*\/){2})

 

Should return https://someurl.com/first/

BUT in Splunk search, this:

 

rex field=referer "referer=(?<referer>^((http[s]?):\/)?\/?([^:\/\s]+)((\w+)*\/){2})

 

is returning the entire url, i.e., https://someurl.com/first/second/third/fourth/etc

What's the proper way to get what I'm looking for? Confused that this works in testers but not Splunk.

Labels (3)
Tags (1)
0 Karma
1 Solution

jotne
Builder

Just count 4 /

| makeresults 
| eval url="https://someurl.com/first/second/third/fourth/etc"
| rex field=url "(?<test>^(?:[^\/]*\/){4})"

View solution in original post

isxtn
Explorer

Thanks!

0 Karma

jotne
Builder

Just count 4 /

| makeresults 
| eval url="https://someurl.com/first/second/third/fourth/etc"
| rex field=url "(?<test>^(?:[^\/]*\/){4})"
Get Updates on the Splunk Community!

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...