Splunk Search

Using REGEX to extract portion of a string from a field

mdeterville
Explorer

Hi Everyone:

I'd like to extract everything after the third "/" below (starting from the left) in the url field below:

url=http://4.3.3.4/pld_accepted_business "

Note: http://4.3.3.4/  will be constant. The latter may change between pld_accepted_business  or pld_accepted_non_business"

Any assistance would be greatly appreciated.

Labels (2)
1 Solution

inventsekar
Super Champion

Hi @mdeterville Please check this.. 

| makeresults 
| eval log="url=http://4.3.3.4/pld_accepted_business" 
| rex field=log "4\/(?<StrPortion>.*)"
| table log StrPortion

rex-field.jpg

View solution in original post

inventsekar
Super Champion

Hi @mdeterville Please check this.. 

| makeresults 
| eval log="url=http://4.3.3.4/pld_accepted_business" 
| rex field=log "4\/(?<StrPortion>.*)"
| table log StrPortion

rex-field.jpg

View solution in original post

mdeterville
Explorer

This works! Thanks for the quick turnaround @inventsekar!

0 Karma

admin12345678
Path Finder

| makeresults
| eval url=split("http://4.3.3.4/pld_accepted_business",",")
| mvexpand url
| rex field=url ".*\/+.*\/(?<new>.*)"