Splunk Search

What is the regular expression that will get the servlet name in a URL?

rbathla
New Member

Taking an example below, I am looking to be make a regular expression that will give me name of servlet form below (after last slash and first question mark).

URL:
/shop/mystore/ProductDisplay?urlRequestType=Base

Result:
ProductDisplay

Tags (1)
0 Karma

gokadroid
Motivator

try this if say your url is in field myField

your query to return the events
| rex field=myField "\/([^\/]+\/)*(?<servlet>[^\?]+)\?.*"
| table servlet

See regex at work here

If the field is not already extracted then try it generally with or without string field=_raw in below query:

your query to return the events
| rex field=_raw  "\/([^\/]+\/)*(?<servlet>[^\?]+)\?.*"
| table servlet
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...