Splunk Search

How to return a url only to the 2nd slash?

isxtn
Explorer

So, this PCRE regex works in testers, but not on Splunk. 

 

^((http[s]?):\/)?\/?([^:\/\s]+)((\w+)*\/){2})

 

Should return https://someurl.com/first/

BUT in Splunk search, this:

 

rex field=referer "referer=(?<referer>^((http[s]?):\/)?\/?([^:\/\s]+)((\w+)*\/){2})

 

is returning the entire url, i.e., https://someurl.com/first/second/third/fourth/etc

What's the proper way to get what I'm looking for? Confused that this works in testers but not Splunk.

Labels (3)
Tags (1)
0 Karma
1 Solution

jotne
Builder

Just count 4 /

| makeresults 
| eval url="https://someurl.com/first/second/third/fourth/etc"
| rex field=url "(?<test>^(?:[^\/]*\/){4})"

View solution in original post

isxtn
Explorer

Thanks!

0 Karma

jotne
Builder

Just count 4 /

| makeresults 
| eval url="https://someurl.com/first/second/third/fourth/etc"
| rex field=url "(?<test>^(?:[^\/]*\/){4})"
Get Updates on the Splunk Community!

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

 Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research Team (STRT) and ...