Splunk Search

How to trim each event and create a field to extract only particular words?

Allampally
Path Finder

Hi Experts,

I have few logs as below, i want to capture all unregistered uri (from unregistered uri text to end of the each line) and put them all in one new field. I need to exclude some text in each line of the event

12:39:25.749 AM
30-Apr-2019 00:39:25.749 INFO [Thread-532] org.apache.catalina.core.StandardService.stopInternal Stopping service [Catalina]
ApplicationRegistry- Unregistered the uri /google/page for "leaked issue"
ApplicationRegistry- Unregistered the uri /facebook/line for "closed connection"
ApplicationRegistry- Unregistered the uri /redmi/router for "open page"

13:39:25.749 AM
30-Apr-2019 00:39:25.749 INFO [Thread-652] org.apache.catalina.core.StandardService.stopInternal Stopping service [Catalina]
ApplicationRegistry- Unregistered the uri /twitter/com for "job manager"
ApplicationRegistry- Unregistered the uri /snapchat/in for "kick off"
ApplicationRegistry- Unregistered the uri /cooler/net for "inner string"

0 Karma

Sukisen1981
Champion
<your index/source> | rex field=_raw "ApplicationRegistry-(?<text>.*)" max_match=0|table text
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...