Splunk Search

Regex string end of the url and in between

panandshah
New Member

10.1.151.100 [18/May/2018:09:09:57 +0200] "GET http://example.com/DCQ/templates/GetAggregated?channel=TV&contentId=4ek4k4&lang=eng HTTP/1.1" 200 2856 hit 0.000111 hit - 154.176.135.239
10.1.51.16 [18/May/2018:09:20:42 +0200] "GET http://video-play.vodacom.co.za/AVS/besc?action=GetIsFavorite&channel=IPHONE&contentId=1200668 HTTP/1.1" 200 113 miss 0.007757 miss - 19.392.33.103
10.1.51.16 [18/May/2018:08:37:51 +0200] "GET http://example.com/AVS/besc?username=00007&channel=ANDROID&action=GetAccountList HTTP/1.1" 200 1516 miss 0.030941 miss - 203.122.32.11

I tried this but it does not print the ones with action=<> that are at the end of the url.
index=index-name_idx earliest=-1h | rex "(?i)action=(?P[^&]+)" |stats count by test
index=index-name_idx earliest=-1h | rex "(?i)action=(?P[^&]+|[\s]+)" |stats count by test

The result i get is:
CheckSession 444
DeleteFavourite 1
GetAccountList 116
GetAccountList HTTP/1.1" 200 1516 miss 0.030941 miss - 119.92.253.103 1
GetAccountList HTTP/1.1" 200 1898 miss 0.029884 miss - 119.92.253.103 1
GetAccountList HTTP/1.1" 200 1902 miss 0.023020 miss - 119.92.253.103 1

I want result for action=<> anything sorted by channel= and count but the key action could be anywhere in the URL and hence i dont get the exact count.

How do we use regex to find action=<> if it is at the end of the URL.

Tags (1)
0 Karma
1 Solution

niketn
Legend

@panandshah, please use the Code button ie. button with 101010 or shortcut key CTRL+K while posting data or code so that special characters do not escape.

Based on the data sample provided, can you try the following regex?

  index=index-name_idx earliest=-1h | 
 | rex  "action=(?<action>[^\&\s]+)[&|\s]"

What is the action field in the first example is there a pattern for that?
Also the third data has channel=ANDROID∾tion=GetAccountList is the character actually present in your raw data or is it due to copy paste and the character is actually ac.?
Do you need to extract channel as well?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@panandshah, please use the Code button ie. button with 101010 or shortcut key CTRL+K while posting data or code so that special characters do not escape.

Based on the data sample provided, can you try the following regex?

  index=index-name_idx earliest=-1h | 
 | rex  "action=(?<action>[^\&\s]+)[&|\s]"

What is the action field in the first example is there a pattern for that?
Also the third data has channel=ANDROID∾tion=GetAccountList is the character actually present in your raw data or is it due to copy paste and the character is actually ac.?
Do you need to extract channel as well?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

panandshah
New Member

That works indeed!! Thanks

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...