Splunk Search

Regex for digits before .zip

jacqu3sy
Path Finder

Hi,

How do I write a regex to capture whenever I see any combination of 10 digits followed by .zip within a _raw event?

eg:

url=www.abcdef.com/1234532419.zip

Thanks.

Tags (2)
0 Karma
1 Solution

vnravikumar
Champion

Try like

| rex field=url "\/(?P<result>\d{10}.zip)"

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

... | rex field=url mode=sed "s/\.zip//"
0 Karma

vnravikumar
Champion

Try like

| rex field=url "\/(?P<result>\d{10}.zip)"
0 Karma

jacqu3sy
Path Finder

ah yeh, how would I capture the whole URL though in the new result field? rather than just the 6 digits?

0 Karma

vnravikumar
Champion

what is your expected result?

0 Karma

jacqu3sy
Path Finder

Expected result is the full URL listed, but to only pull back URL's that match the regex, i.e. 10 digits followed by .zip

url=www.abcdef.com/1234532419.zip

0 Karma

vnravikumar
Champion

Check this rex (?P<result>url=\S+\/\d{10}.zip)

0 Karma

jacqu3sy
Path Finder

Perfect. Many thanks 🙂

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jacqu3sy

Try this:

YOUR SEARCH | rex field=url "(?<data>\d.*).zip"

Sample

|makeresults | eval url="www.abcdef.com/1234532419.zip" | rex field=url "(?<data>\d.*).zip"

jacqu3sy
Path Finder

ah yeh, how would I capture the whole URL though in the new data field? rather than just the 6 digits?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...