Splunk Search

How to trim URL after the last "/"

New Member

I'm trying to trim the URL's for a particular search, where it removes everything after the last "/".
In other words:

From:
fqdn/A/B/C/file.png
To Return:
fqdn/A/B/C

I tried using rtrim, but did not work for me.
Any help with this will be greatly appreciated!

Tags (3)
0 Karma
1 Solution

Champion

Hi

Try this rex

| makeresults 
| eval url="fqdn/A/B/C/file.png" 
| rex field=url "^(?P<test>.*[\/])" 
| eval result = replace(test,"\/$","")

View solution in original post

Esteemed Legend

There are many ways to do this, including:

... | rex field=url mode=sed "s/\/[^\/]+$//"
0 Karma

New Member

Thanks a lot... this worked as well. Would mark it as "Accept", but I can only accept "one" answer. Appreciate it!

0 Karma

SplunkTrust
SplunkTrust

The trim function doesn't do what you think it does, although it would be nice if it did.

There are other ways to accomplish the task. The URL Toolkit app will parse the URL for you and let you choose any part(s) you like.
The rex command can do it, too.

... | rex field=url "(?<url>.*)\/"
---
If this reply helps you, an upvote would be appreciated.
0 Karma

New Member

Thanks a lot... this worked as well. Would mark it as "Accept", but I can only accept "one" answer. Appreciate it!

0 Karma

Esteemed Legend

You can UpVote as many answers or comments as you like, especially those that taught you something new and worked.

0 Karma

Champion

Try this!

| makeresults |eval url="FQDN/A/B/C/file.png"
| eval object=mvindex(split(url,"/"),mvcount(split(url,"/"))-1)
| eval url=rtrim(url,"/"+object)
0 Karma

New Member

Thanks a lot... this worked as well. Would mark it as "Accept", but I can only accept "one" answer. Appreciate it!

0 Karma

Champion

Hi

Try this rex

| makeresults 
| eval url="fqdn/A/B/C/file.png" 
| rex field=url "^(?P<test>.*[\/])" 
| eval result = replace(test,"\/$","")

View solution in original post

New Member

Thanks so much! This worked!

0 Karma

Motivator

Slightly simplified version:

| makeresults 
| eval url="fqdn/A/B/C/file.png" 
| rex field=url "^(?P<result>.*)/[^/]+$"
Cheers,
Jacob
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!