Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Regex assistance
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have a field such as - activity="POST->/cirrus/v1.0/providers"
We would like to extract everything after the POST->/cirrus/v1.0/ part.
What would be a way to do it?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This will pull that exact section out of a field called myfield and place it into a field called otherstuff
| rex field=myfield "POST->\/[^\/]+\/[^\/]+\/(?<otherstuff>[^\"]+)"
This will do that and also put the verb into a field called whatverb.
| rex field=myfield "(?<whatverb>POST|DELETE|GET|PUT)->\/[^\/]+\/[^\/]+\/(?<otherstuff>[^\"]+)"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This will pull that exact section out of a field called myfield and place it into a field called otherstuff
| rex field=myfield "POST->\/[^\/]+\/[^\/]+\/(?<otherstuff>[^\"]+)"
This will do that and also put the verb into a field called whatverb.
| rex field=myfield "(?<whatverb>POST|DELETE|GET|PUT)->\/[^\/]+\/[^\/]+\/(?<otherstuff>[^\"]+)"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Perfect!!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
1) is "POST" the only verb you want it for? 2) are there always exactly three slashes in the part you don't want?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That's exactly it ; -)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry sorry - | rex field=activity "POST->/cirrus/v1.0/(?<activity_clean>[a-z]+)" did it...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
please accept your answer to close the question.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ah, you meant that value within quotes was the value of the activity field.
I'd suggest changing that to one of the following -
| rex field=activity "POST->/cirrus/v1.0/(?
or
| rex field=activity "POST->/cirrus/v1.0/(?
...since you probably can't be sure that it will always be only lower-case alpha characters. You also don't know when the cirrus version might change, so you might want to wildcard that as well. I tested this as below.
| makeresults | eval activity="POST->/cirrus/v1.0/providers"
| rex field=activity "POST->/cirrus/[^/]+/(?<activity_clean>.+)"
I was a little surprised the slashes didn't have to be escaped, although the code DID accept escaping them. Live and learn.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I was surprised also about the non-escaping ; -)
Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps
What’s New in Splunk Observability – September 2025
Fun with Regular Expression - multiples of nine
