Splunk Search

How to solve Error parsing URL in Splunk?

Badab
New Member

Hello,

I'm trying to parse URLs in Java logs (*.trace), it works for complete URL with this following request :

index=os_win_wks sourcetype="os_win_wks:java:trace"
| rex field=_raw (?<URL>https?:\/\/\S+)

but I want to stop to the first "/" with this one, then I have an error message :

index=os_win_wks  sourcetype="os_win_wks:java:trace"
| rex (?<url>https?:\/\\[^:\/]+)

Error => Error in 'SearchParser': Missing a search command before '^'. Error at position '75' of search query 'search index=* sourcetype="os_win_wks:java:trace" ...{snipped} {errorcontext = tps?:\/\\[^:\/]+)}'.

Could you help me please ?

Labels (1)
0 Karma
1 Solution

javiergn
Super Champion

Hi @Badab , I think there is a typo as you did not escape a forward slash but a backslash.

It should be like:

 

| rex "(?<url>https?:\/\/[^:\/]+)"

 

 

I've tested it and it seems to do what you are asking:

javiergn_0-1682669301798.png

 

Regards,

J

 

View solution in original post

javiergn
Super Champion

Hi @Badab , I think there is a typo as you did not escape a forward slash but a backslash.

It should be like:

 

| rex "(?<url>https?:\/\/[^:\/]+)"

 

 

I've tested it and it seems to do what you are asking:

javiergn_0-1682669301798.png

 

Regards,

J

 

Badab_one
Engager

It works, thank you !

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...