How to solve Error parsing URL in Splunk?

[Badab]

Hello,

I'm trying to parse URLs in Java logs (*.trace), it works for complete URL with this following request :

index=os_win_wks sourcetype="os_win_wks:java:trace"
| rex field=_raw (?<URL>https?:\/\/\S+)

but I want to stop to the first "/" with this one, then I have an error message :

index=os_win_wks  sourcetype="os_win_wks:java:trace"
| rex (?<url>https?:\/\\[^:\/]+)

Error => Error in 'SearchParser': Missing a search command before '^'. Error at position '75' of search query 'search index=* sourcetype="os_win_wks:java:trace" ...{snipped} {errorcontext = tps?:\/\\[^:\/]+)}'.

Could you help me please ?

[javiergn · Accepted solution]

Hi @Badab , I think there is a typo as you did not escape a forward slash but a backslash.

It should be like:

| rex "(?<url>https?:\/\/[^:\/]+)"

I've tested it and it seems to do what you are asking:

javiergn_0-1682669301798.png

Regards,

J

[Badab_one]

It works, thank you !