Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: creating field for url
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think the regular expression you are looking for is:
\w+\:\/\/[^\s]+
EDIT: Probably get away with using the following, however I have a habit of escaping the characters:
\w+://[^\s]+
You can test this using the rex command, like:
<yourBaseSearch> | rex field=_raw "(?P<url>\w+\:\/\/[^\s]+)" | table _time url _raw
(Don't really need the table part, just makes it easier to match it up).
Once you have your regular expression correct, you can just paste that into the IFX (Interactive Field eXtractor).
Additionally, for testing regular expressions, the following site is very helpful:
Hope this helps.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think the regular expression you are looking for is:
\w+\:\/\/[^\s]+
EDIT: Probably get away with using the following, however I have a habit of escaping the characters:
\w+://[^\s]+
You can test this using the rex command, like:
<yourBaseSearch> | rex field=_raw "(?P<url>\w+\:\/\/[^\s]+)" | table _time url _raw
(Don't really need the table part, just makes it easier to match it up).
Once you have your regular expression correct, you can just paste that into the IFX (Interactive Field eXtractor).
Additionally, for testing regular expressions, the following site is very helpful:
Hope this helps.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Credit goes to @Drainy as he showed me gskinner aaaaaages ago.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
gskinner is truly one of the best online regex testing tools [^]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
2013 Jun 22 09:33:40 tracker1 httpproxy_access[41545]: 10.10.34.17 3398 TCP_MISS/200 0 NONHTTP binary://217.212.238.41:80 - DIRECT/217.212.238.41 - [acl=nonhttp] [cat=-] [err=-]
i have log like this. i want to extract url field. thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
like nr.5 said: need more input
please provide more detailed information about what you want to achieve and provide some example log data - thanks
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
Customer success is front and center at .conf25
