creating field for url

[labani]

How can I create a field for url? I am unable to do it by field extraction.

[MHibbin · Accepted solution]

I think the regular expression you are looking for is:

\w+\:\/\/[^\s]+

EDIT: Probably get away with using the following, however I have a habit of escaping the characters:

\w+://[^\s]+

You can test this using the rex command, like:

<yourBaseSearch> | rex field=_raw "(?P<url>\w+\:\/\/[^\s]+)" | table _time url _raw

(Don't really need the table part, just makes it easier to match it up).

Once you have your regular expression correct, you can just paste that into the IFX (Interactive Field eXtractor).

Additionally, for testing regular expressions, the following site is very helpful:

http://gskinner.com/RegExr/

Hope this helps.

[MHibbin]

Credit goes to @Drainy as he showed me gskinner aaaaaages ago.

[MuS]

gskinner is truly one of the best online regex testing tools [^]

[labani]

2013 Jun 22 09:33:40 tracker1 httpproxy_access[41545]: 10.10.34.17 3398 TCP_MISS/200 0 NONHTTP binary://217.212.238.41:80 - DIRECT/217.212.238.41 - [acl=nonhttp] [cat=-] [err=-]
i have log like this. i want to extract url field. thank you

[MuS]

like nr.5 said: need more input
please provide more detailed information about what you want to achieve and provide some example log data - thanks