field extraction

[sarit_s]

Hello
i have this part of event :

"POST /posts/posts/explore HTTP/1.0"

i need to extract the part between "POST" and "HTTP"
which "POST" can be anything, for example "GET", "PUSH", etc.
also, the string between "POST" and "HTTP" can contain only 1 '/', for example "POST /search HTTP..."
what is the right regular expression for that ?

thanks !

[to4kawa · Accepted solution]

your_search
| rex "[A-Z]+\s(?<url>.+?)\sHTTP\/\d\.\d"

Hi, how about this?

[p_gurav]

What is the data source for this logs? If this are access logs then try to use splunk predefined sourcetypes.

[sarit_s]

its log file that i added manually from "add data" option