Splunk Search

field extraction

sarit_s
Communicator

Hello
i have this part of event :

"POST /posts/posts/explore HTTP/1.0"

i need to extract the part between "POST" and "HTTP"
which "POST" can be anything, for example "GET", "PUSH", etc.
also, the string between "POST" and "HTTP" can contain only 1 '/', for example "POST /search HTTP..."
what is the right regular expression for that ?

thanks !

0 Karma
1 Solution

to4kawa
Ultra Champion
your_search
| rex "[A-Z]+\s(?<url>.+?)\sHTTP\/\d\.\d"

Hi, how about this?

View solution in original post

0 Karma

to4kawa
Ultra Champion
your_search
| rex "[A-Z]+\s(?<url>.+?)\sHTTP\/\d\.\d"

Hi, how about this?

0 Karma

p_gurav
Champion

What is the data source for this logs? If this are access logs then try to use splunk predefined sourcetypes.

0 Karma

sarit_s
Communicator

its log file that i added manually from "add data" option

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...