Splunk Search

Regex for digits before .zip

Path Finder

Hi,

How do I write a regex to capture whenever I see any combination of 10 digits followed by .zip within a _raw event?

eg:

url=www.abcdef.com/1234532419.zip

Thanks.

Tags (2)
0 Karma
1 Solution

Champion

Try like

| rex field=url "\/(?P<result>\d{10}.zip)"

View solution in original post

0 Karma

Esteemed Legend

Like this:

... | rex field=url mode=sed "s/\.zip//"
0 Karma

Champion

Try like

| rex field=url "\/(?P<result>\d{10}.zip)"

View solution in original post

0 Karma

Path Finder

ah yeh, how would I capture the whole URL though in the new result field? rather than just the 6 digits?

0 Karma

Champion

what is your expected result?

0 Karma

Path Finder

Expected result is the full URL listed, but to only pull back URL's that match the regex, i.e. 10 digits followed by .zip

url=www.abcdef.com/1234532419.zip

0 Karma

Champion

Check this rex (?P<result>url=\S+\/\d{10}.zip)

0 Karma

Path Finder

Perfect. Many thanks 🙂

0 Karma

SplunkTrust
SplunkTrust

@jacqu3sy

Try this:

YOUR SEARCH | rex field=url "(?<data>\d.*).zip"

Sample

|makeresults | eval url="www.abcdef.com/1234532419.zip" | rex field=url "(?<data>\d.*).zip"

Path Finder

ah yeh, how would I capture the whole URL though in the new data field? rather than just the 6 digits?

0 Karma