Splunk Search

field extraction

Communicator

Hello
i have this part of event :

"POST /posts/posts/explore HTTP/1.0"

i need to extract the part between "POST" and "HTTP"
which "POST" can be anything, for example "GET", "PUSH", etc.
also, the string between "POST" and "HTTP" can contain only 1 '/', for example "POST /search HTTP..."
what is the right regular expression for that ?

thanks !

0 Karma
1 Solution

Ultra Champion
your_search
| rex "[A-Z]+\s(?<url>.+?)\sHTTP\/\d\.\d"

Hi, how about this?

View solution in original post

0 Karma

Ultra Champion
your_search
| rex "[A-Z]+\s(?<url>.+?)\sHTTP\/\d\.\d"

Hi, how about this?

View solution in original post

0 Karma

Champion

What is the data source for this logs? If this are access logs then try to use splunk predefined sourcetypes.

0 Karma

Communicator

its log file that i added manually from "add data" option

0 Karma