help with regex

[vrmandadi]

I have the below sample data, and I want to extract everything after the service URL till maxd=60&mind=60 into a new field called service.

I have used (?i) url: (?P.+?)\w+= but it is not extracting completly

31 Jan 2018 20:22:13 [INFO ] AD Transaction: timestamp: 1513204259, transactionID: 2899739, reqID: 3022368026, uuid: 72dca744-b342-4aac-9861-005056b21335, type: ad request, transaction: start, service url: http://mrm.mdc.time.com/ad/p/1?nw=376521&mode=live&vdur=600&flag=+sltp+amsl+ssus+amcb+dtrd&metr=1031..., client url: http://mmdai-linear-west-01.time.com

[mayurr98]

hey try this run anywhere search

| makeresults 
| eval _raw="31 Jan 2018 20:22:13 [INFO ] AD Transaction: timestamp: 1513204259, transactionID: 2899739, reqID: 3022368026, uuid: 72dca744-b342-4aac-9861-005056b21335, type: ad request, transaction: start, service url: http://mrm.mdc.time.com/ad/p/1?nw=376521&mode=live&vdur=600&flag=+sltp+amsl+ssus+amcb+dtrd&metr=1031..., client url: http://mmdai-linear-west-01.time.com"; 
| rex field=_raw "service\surl\:\s+(?<service_URL>.*)&maxd=60&mind=60"

In your environment, you should write

<base_search> | rex field=_raw "service\surl\:\s+(?<service_URL>.*)&maxd=60&mind=60"

let me know if this helps!

[493669 · Accepted solution]

try this also:

...| rex "(?i)service url:\s*(?<service>.*)&maxd=60&mind=60" 

[vrmandadi]

This helped,made some changes to it..Thanks

[gokadroid]

How about trying this:

your query to return events
| rex "service url:\s*(?<service>.*)&maxd=60&mind=60"
| table service

see extraction here