Regex help in Splunk

[Shashank_87]

Hi, I have few events in splunk like these -
1. "GET /test/materials/components/fields HTTP/1.1"
2. "GET /test1 HTTP/1.1" OR "GET /test2 HTTP/1.1
Now what i want is just to see the events which are like in the 2nd point. My query should ignore the 1st one's. The 2nd type of URL has a pattern that it has only one word after "/".

Can some one help?

[ragedsparrow · Accepted solution]

You can not exclude with a regex pattern in your base search. You have to put it through the regex transformation to exclude events in the search via regex pattern matching. Example:

base search | regex url="\w+\s\/\w+\s.*"

That would only match the 2nd example shown

If you don't need the events at all, you may want to consider routing them to the nullQueue: https://docs.splunk.com/Documentation/Splunk/7.2.5/Forwarding/Routeandfilterdatad

The 2nd option will allow you to send specific events that you do not want to the nullQueue and they are not indexed. If you want it all to be indexed and then filtered at search time, you will need to use the regex specific transformation commands to filter them out.

[somesoni2]

This is the full raw data OR full value of field??

your base search | regex _raw=".+\"\w+\s+\/\S+\s+\w+\/\d+\.\d+\".+"

OR if the extracted field name is URL

your base search | regex URL="\w+\s+\/\S+\s+\w+\/\d+\.\d+"

[Shashank_87]

Hi Somesoni2, The above 2 points which i mentioned are 2 different events in my index. What i want is to fetch only 2nd type of events and exclude the 1st one's.
What will be the query look like?

[somesoni2]

My solution is considering type 2 events. Try the same.

[ehowardl3]

As far the regex goes, the following will only match the examples in point 2:

\w+\s\/\w+\s.*

-E

[Shashank_87]

Hi ehoward, Thank you for the response. Is there a way to exclude this in the search itself? I mean within the search query can we exclude all the URL's apart from the one's who follow pattern as 2nd point. This way we reduce the overhead and number of events