Hello,
I'm trying to parse URLs in Java logs (*.trace), it works for complete URL with this following request :
index=os_win_wks sourcetype="os_win_wks:java:trace" | rex field=_raw (?<URL>https?:\/\/\S+)
but I want to stop to the first "/" with this one, then I have an error message :
index=os_win_wks sourcetype="os_win_wks:java:trace" | rex (?<url>https?:\/\\[^:\/]+)
Error => Error in 'SearchParser': Missing a search command before '^'. Error at position '75' of search query 'search index=* sourcetype="os_win_wks:java:trace" ...{snipped} {errorcontext = tps?:\/\\[^:\/]+)}'.
Could you help me please ?
... View more