Splunk Search

How to truncate a field value after a regex pattern?

mbolostk
Explorer

How can I truncate a field value after a given pattern. For example, if I am looking at web page logs, how can I truncate everything after .html so that no parameters or variables are reported in my web page count?

Tags (2)
0 Karma
1 Solution

mbolostk
Explorer

I figured it out. Nevermind. It was based on the first post - but had to redo the regex as the uri didn't, in this case, start with http://

View solution in original post

0 Karma

mbolostk
Explorer

I figured it out. Nevermind. It was based on the first post - but had to redo the regex as the uri didn't, in this case, start with http://

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

If you already have the field extracted, then you can use eval or rex to create a new field to extract the first part of the URL with something like (using eval):

eval mainpart=replace(origurl,"(.*)[?].*","\1")

Where origurl is the already extracted URL field, and ? is the ? in the URL for separating the Parameters from the rest of the URL. That will enable you to have more than .html at the end of the URL (like jpeg, js css, etc). The REX would be like the example already given by aljohnson_splunk. If your logs don't include the http:// (as many apache log files do), then your rex would need to allow for finding the URL differently from his example.

aljohnson_splun
Splunk Employee
Splunk Employee

Things that will help us help you:

  1. Post sample data
  2. Post sample search
  3. Post desired output

It sorta sounds like you want to use the rex command.
E.g.

| rex field=url_field "http://(?<url_path>.+html)"
| stats count by url_path

jrodman
Splunk Employee
Splunk Employee

For this particular goal, I would usually make the .+ be ungreedy with .+?

e.g.

| rex field=url_field "http://(?<url_path>.+?html)"
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...