Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Regex for uri path
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Regex for uri path
Hi,
I'm having trouble extracting the uri_path of my log files.
Here's an example of a line in my log file
115.252.41.38 "65.165.121.16" - www.site.com [27/Feb/2014:23:29:59 -0500] "GET /images/focus/gallery/?zipCode=70006&distance=50 HTTP/1.1" 200 67362 1 esds036b.md5.site.com:9789 "-" "Mozilla/5.0 (iPad; CPU OS 7_0_4 like Mac OS X) AppleWebKit/537.51.1 (KHTML, like Gecko) Version/7.0 Mobile/11B554a Safari/9537.53"
I'm trying to extract out "/images/focus/gallery/" with a Regex, but am having difficulties in doing so. Any help is appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For the weblogs, I just used the inline field extractor with some small changes to extract the uriPath from the uri field that was imported from the AWS ELB logs I received. The main issue is some URIs have query fields (?key=value) and some do not. This has worked for me so far.
rex field=uri "(?i)^(?:[^/]*/){3}(?P<uriPath>[^(\?|\s)]+)"
If I make any more changes, I will update the rex.
Also you can check out the URL Parser app in the Splunk App Store. Just take note that it has errors in the code that have to be corrected. They are noted here.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this:
search | regex "\s/[^ ]+/[^ ]+/[^ ]+/"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can try rex:
search | rex "^.*\s(?P<uri_path>/[^ ]+/[^ ]+/[^ ]+/)\S"
That should pull out a uri_path field that can be used for statistics or charting.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How would I extract the path out to a variable to chart it? For example the top used paths using "top limit=2 uri_path"
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions
Splunk Community Badges!
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
