Splunk Search

Using REGEX to extract portion of a string from a field

mdeterville
Path Finder

Hi Everyone:

I'd like to extract everything after the third "/" below (starting from the left) in the url field below:

url=http://4.3.3.4/pld_accepted_business "

Note: http://4.3.3.4/  will be constant. The latter may change between pld_accepted_business  or pld_accepted_non_business"

Any assistance would be greatly appreciated.

Labels (2)
1 Solution

inventsekar
Super Champion

Hi @mdeterville Please check this.. 

| makeresults 
| eval log="url=http://4.3.3.4/pld_accepted_business" 
| rex field=log "4\/(?<StrPortion>.*)"
| table log StrPortion

rex-field.jpg

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.

View solution in original post

inventsekar
Super Champion

Hi @mdeterville Please check this.. 

| makeresults 
| eval log="url=http://4.3.3.4/pld_accepted_business" 
| rex field=log "4\/(?<StrPortion>.*)"
| table log StrPortion

rex-field.jpg

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.

mdeterville
Path Finder

This works! Thanks for the quick turnaround @inventsekar!

0 Karma

admin12345678
Path Finder

| makeresults
| eval url=split("http://4.3.3.4/pld_accepted_business",",")
| mvexpand url
| rex field=url ".*\/+.*\/(?<new>.*)"

Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...