Splunk Search

How to solve Error parsing URL in Splunk?

Badab
New Member

Hello,

I'm trying to parse URLs in Java logs (*.trace), it works for complete URL with this following request :

index=os_win_wks sourcetype="os_win_wks:java:trace"
| rex field=_raw (?<URL>https?:\/\/\S+)

but I want to stop to the first "/" with this one, then I have an error message :

index=os_win_wks  sourcetype="os_win_wks:java:trace"
| rex (?<url>https?:\/\\[^:\/]+)

Error => Error in 'SearchParser': Missing a search command before '^'. Error at position '75' of search query 'search index=* sourcetype="os_win_wks:java:trace" ...{snipped} {errorcontext = tps?:\/\\[^:\/]+)}'.

Could you help me please ?

Labels (1)
0 Karma
1 Solution

javiergn
Super Champion

Hi @Badab , I think there is a typo as you did not escape a forward slash but a backslash.

It should be like:

 

| rex "(?<url>https?:\/\/[^:\/]+)"

 

 

I've tested it and it seems to do what you are asking:

javiergn_0-1682669301798.png

 

Regards,

J

 

View solution in original post

javiergn
Super Champion

Hi @Badab , I think there is a typo as you did not escape a forward slash but a backslash.

It should be like:

 

| rex "(?<url>https?:\/\/[^:\/]+)"

 

 

I've tested it and it seems to do what you are asking:

javiergn_0-1682669301798.png

 

Regards,

J

 

Badab_one
Engager

It works, thank you !

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...