Splunk Search
Highlighted

creating field for url

Explorer

How can I create a field for url? I am unable to do it by field extraction.

Tags (1)
0 Karma
Highlighted

Re: creating field for url

SplunkTrust
SplunkTrust

like nr.5 said: need more input
please provide more detailed information about what you want to achieve and provide some example log data - thanks

0 Karma
Highlighted

Re: creating field for url

Explorer

2013 Jun 22 09:33:40 tracker1 httpproxyaccess[41545]: 10.10.34.17 3398 TCPMISS/200 0 NONHTTP binary://217.212.238.41:80 - DIRECT/217.212.238.41 - [acl=nonhttp] [cat=-] [err=-]
i have log like this. i want to extract url field. thank you

0 Karma
Highlighted

Re: creating field for url

Influencer

I think the regular expression you are looking for is:

\w+\:\/\/[^\s]+

EDIT: Probably get away with using the following, however I have a habit of escaping the characters:

\w+://[^\s]+

You can test this using the rex command, like:

<yourBaseSearch> | rex field=_raw "(?P<url>\w+\:\/\/[^\s]+)" | table _time url _raw

(Don't really need the table part, just makes it easier to match it up).

Once you have your regular expression correct, you can just paste that into the IFX (Interactive Field eXtractor).

Additionally, for testing regular expressions, the following site is very helpful:

http://gskinner.com/RegExr/

Hope this helps.

View solution in original post

Highlighted

Re: creating field for url

SplunkTrust
SplunkTrust

gskinner is truly one of the best online regex testing tools [^]

0 Karma
Highlighted

Re: creating field for url

Influencer

Credit goes to @Drainy as he showed me gskinner aaaaaages ago.

0 Karma