Splunk Search

How to trim URL after the last "/"

RaymondN80
New Member

I'm trying to trim the URL's for a particular search, where it removes everything after the last "/".
In other words:

From:
fqdn/A/B/C/file.png
To Return:
fqdn/A/B/C

I tried using rtrim, but did not work for me.
Any help with this will be greatly appreciated!

Tags (3)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Try this rex

| makeresults 
| eval url="fqdn/A/B/C/file.png" 
| rex field=url "^(?P<test>.*[\/])" 
| eval result = replace(test,"\/$","")

View solution in original post

woodcock
Esteemed Legend

There are many ways to do this, including:

... | rex field=url mode=sed "s/\/[^\/]+$//"
0 Karma

RaymondN80
New Member

Thanks a lot... this worked as well. Would mark it as "Accept", but I can only accept "one" answer. Appreciate it!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The trim function doesn't do what you think it does, although it would be nice if it did.

There are other ways to accomplish the task. The URL Toolkit app will parse the URL for you and let you choose any part(s) you like.
The rex command can do it, too.

... | rex field=url "(?<url>.*)\/"
---
If this reply helps you, Karma would be appreciated.
0 Karma

RaymondN80
New Member

Thanks a lot... this worked as well. Would mark it as "Accept", but I can only accept "one" answer. Appreciate it!

0 Karma

woodcock
Esteemed Legend

You can UpVote as many answers or comments as you like, especially those that taught you something new and worked.

0 Karma

HiroshiSatoh
Champion

Try this!

| makeresults |eval url="FQDN/A/B/C/file.png"
| eval object=mvindex(split(url,"/"),mvcount(split(url,"/"))-1)
| eval url=rtrim(url,"/"+object)
0 Karma

RaymondN80
New Member

Thanks a lot... this worked as well. Would mark it as "Accept", but I can only accept "one" answer. Appreciate it!

0 Karma

vnravikumar
Champion

Hi

Try this rex

| makeresults 
| eval url="fqdn/A/B/C/file.png" 
| rex field=url "^(?P<test>.*[\/])" 
| eval result = replace(test,"\/$","")

RaymondN80
New Member

Thanks so much! This worked!

0 Karma

jacobpevans
Motivator

Slightly simplified version:

| makeresults 
| eval url="fqdn/A/B/C/file.png" 
| rex field=url "^(?P<result>.*)/[^/]+$"
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...