Splunk Search

Using REGEX to extract part of a combination of URLs

mdeterville
Path Finder

Hello SMEs:

I need some assistance extracting everything between the 5th and 6th "/" from URLs like the one below. 

Note: URLs may change. 

https://notify.webproxy.com/https://www.elitetools.ca/en/

Your assistance would be appreciated!

Labels (1)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

The new value will be extracted to url field.

| rex field=<yourfield> "(?:[^\/]*\/){5}(?<url>[^\/]+)"

 

————————————
If this helps, give a like below.

View solution in original post

thambisetty
SplunkTrust
SplunkTrust

you can make use of same regex I shared above.

for example: 


1. Everything between the 3rd and 4th "/"  - lets call this "button_click"

for above: replace {5} with 4 and replace url with button_click

2. Everything between the 6th and 7th "/" - lets call this "domain_ref"

for above : replace {5} with 6 and replace url with domain_ref

————————————
If this helps, give a like below.

thambisetty
SplunkTrust
SplunkTrust

The new value will be extracted to url field.

| rex field=<yourfield> "(?:[^\/]*\/){5}(?<url>[^\/]+)"

 

————————————
If this helps, give a like below.

mdeterville
Path Finder

Thanks so much @thambisetty ! This worked well!

I was just wondering, what would the new rex's be for capturing 2 new fields:

1. Everything between the 3rd and 4th "/"  - lets call this "button_click"

2. Everything between the 6th and 7th "/" - lets call this "domain_ref"

FROM:

https://notify.webproxy.com/User_Clicked_non-business/https://www.elitetools.ca/

Note: URLS and Button click types may change.

Thanks again for your quick turnaround!

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...