×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
laurentiugrama
Explorer
Member since: ‎08-25-2021
‎09-01-2021
Community Statistics
Posts 6
Solutions 0
Karma Given 4
Karma Received 0
Member Since ‎08-25-2021
Activity Feed
View All

Re: regexp in Splunk

by in Getting Data In
‎09-01-2021 12:55 AM
‎09-01-2021 12:55 AM
Your solution it works well. Do you think that it's possible to have a solution based on only one regexp iteration ? ... View more

Re: regexp in Splunk

by in Getting Data In
‎08-31-2021 12:48 AM
‎08-31-2021 12:48 AM
In the first post I explained what is the URL and what I want to obtain from regext for first line the url is /gw/api/aaa/v1/ and the baseurl is /gw/api/aaa/v1 GET /gw/api/aaa/v1/ HTTP - to return /gw/api/aaa/v1 GET /gw/api/abc/v3 HTTP - to return /gw/api/abc/v3 POST /gw/api/cba/ HTTP - to return /gw/api/cba POST /gw/transactions/swaggers/v2 HTTP - to return /gw/transactions/swaggers/v2 POST /gw/api/swaggers/v1/asd?dssa HTTP - to return /gw/api/swaggers/v1/asd POST /api/swaggers/ HTTP - to return /api/swaggers GET /api/cashAccountOpenings/v3/sadsa-123312-1312 HTTP - to return /api/cashAccountOpenings/v3 ... View more

Re: regexp in Splunk

by in Getting Data In
‎08-31-2021 12:26 AM
‎08-31-2021 12:26 AM
Thank you for the response but the expression returns URL not  baseurl As I said, I trayed to obtain the baseurl from an url ... View more

regexp in Splunk

by in Getting Data In
‎08-31-2021 12:04 AM
‎08-31-2021 12:04 AM
I tried to find a solution in order to parse some URL to obtain the base but it seems that I cannot succeed. For the between GET/POST and HTTP I want to return the baseurl as in the examples below GET /gw/api/aaa/v1/ HTTP - to return /gw/api/aaa/v1 GET /gw/api/abc/v3 HTTP - to return /gw/api/abc/v3 POST /gw/api/cba/ HTTP - to return /gw/api/cba POST /gw/transactions/swaggers/v2 HTTP - to return /gw/transactions/swaggers/v2 POST /gw/api/swaggers/v1/asd?dssa HTTP - to return /gw/api/swaggers/v1/asd POST /api/swaggers/ HTTP - to return /api/swaggers GET /api/cashAccountOpenings/v3/sadsa-123312-1312 HTTP - to return /api/cashAccountOpenings/v3   I added this examples to regex101.com to be easier to find a solution. https://regex101.com/r/oLXtw8/1/   ... View more
Labels

Re: get baseurl for different addresses

by in Getting Data In
‎08-27-2021 03:06 AM
‎08-27-2021 03:06 AM
Thank you for the solution. It helps me a lot. It seems that that the url ended in "/" it's not treated but I will try to find a solution ... View more

get baseurl for different addresses

by in Getting Data In
‎08-25-2021 04:28 AM
‎08-25-2021 04:28 AM
In my logs I have different url and i need to fins a smart way to get the base_url. The urls are: /gw/api/request/assets?AccountId=710534357902&reportDate=2021-08-25     - I want to obtain  /gw/api/request/assets /gw/api/oidc/client/v1     - I want to obtain  /gw/api/oidc/client/v1 /gw/api/oidc/client/v1/     - I want to obtain  /gw/api/oidc/client/v1 /gw/api/AccountOpenings/423423423-32sdf-34243    - I want to obtain /gw/api/AccountOpenings /gw/api/AccountOpenings/345645fgh5-54hju-45565- I want to obtain /gw/api/AccountOpenings Can I use a single regexp to do that ? Now I use something like this but I don't think that is the right way   | eval a=split(URL,"?")|eval URL=mvindex(a,0) | rex field=URL "(?<base_url>.*AccountOpenings/v[0-9]).*" | eval URL=if(match(URL,"AccountOpenings" ),base_url,URL)     ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎09-01-2021 04:21 AM
Karma given to
View All