Need help with rex

[xvxt006]

Hi,

i am using this expression - base search | rex field=uri "better\?q=(?[^&]+)$"

and i was expecting to return events which ends with having only q value but not having others as shown below.

better?q=GARAGE+DOOR+9+FT+WIDE

but it is showing all the events which have values after & (startIndex=000041&itemsperpage=0030)

better?q=GARAGE+DOOR+9+FT+WIDE&startIndex=000041&itemsperpage=0030

Any idea what i am missing here?

[somesoni2]

Try this (run anywhere)

|stats count | eval uri="better?q=GARAGE+DOOR+9+FT+WIDE##better?q=GARAGE+DOOR+9+FT+WIDE&startIndex=000041&itemsperpage=0030" | table uri | makemv delim="##" uri | mvexpand uri  
| regex uri="better\?q=([^&]+)$"


<<Your base search with field uri >>  | regex uri="better\?q=([^&]+)$"

[somesoni2]

That is just a syntax to get example data to work on(since I don't have sample logs). Just replace everything before "regex" command with your base search.

[xvxt006]

i see that you are using eval for the acutal uri i gave. But I just gave an example to show you what i want. I have lot of events like that. I cannot put all of those in my search query right?

[richgalloway]

I had success in RegExr with this string:

better\?q=([^&]+)&