Splunk Search

Regex for digits before .zip

jacqu3sy
Path Finder

Hi,

How do I write a regex to capture whenever I see any combination of 10 digits followed by .zip within a _raw event?

eg:

url=www.abcdef.com/1234532419.zip

Thanks.

Tags (2)
0 Karma
1 Solution

vnravikumar
Champion

Try like

| rex field=url "\/(?P<result>\d{10}.zip)"

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

... | rex field=url mode=sed "s/\.zip//"
0 Karma

vnravikumar
Champion

Try like

| rex field=url "\/(?P<result>\d{10}.zip)"
0 Karma

jacqu3sy
Path Finder

ah yeh, how would I capture the whole URL though in the new result field? rather than just the 6 digits?

0 Karma

vnravikumar
Champion

what is your expected result?

0 Karma

jacqu3sy
Path Finder

Expected result is the full URL listed, but to only pull back URL's that match the regex, i.e. 10 digits followed by .zip

url=www.abcdef.com/1234532419.zip

0 Karma

vnravikumar
Champion

Check this rex (?P<result>url=\S+\/\d{10}.zip)

0 Karma

jacqu3sy
Path Finder

Perfect. Many thanks 🙂

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jacqu3sy

Try this:

YOUR SEARCH | rex field=url "(?<data>\d.*).zip"

Sample

|makeresults | eval url="www.abcdef.com/1234532419.zip" | rex field=url "(?<data>\d.*).zip"

jacqu3sy
Path Finder

ah yeh, how would I capture the whole URL though in the new data field? rather than just the 6 digits?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...