Splunk Search

What is the regular expression that will get the servlet name in a URL?

rbathla
New Member

Taking an example below, I am looking to be make a regular expression that will give me name of servlet form below (after last slash and first question mark).

URL:
/shop/mystore/ProductDisplay?urlRequestType=Base

Result:
ProductDisplay

Tags (1)
0 Karma

gokadroid
Motivator

try this if say your url is in field myField

your query to return the events
| rex field=myField "\/([^\/]+\/)*(?<servlet>[^\?]+)\?.*"
| table servlet

See regex at work here

If the field is not already extracted then try it generally with or without string field=_raw in below query:

your query to return the events
| rex field=_raw  "\/([^\/]+\/)*(?<servlet>[^\?]+)\?.*"
| table servlet
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...