About tengugurl1

tengugurl1 · ‎09-03-2024

May I ask another silly question, I am getting closer to what I need, if I had the following examples: /rest/Apple/1.0/ /rest/Banana/2/ /rest/structure/2.0/ How could I define a variable via regex to best tease out whats an apple, banana and or structure I tried what you provided below but its giving me the full log. I just need it to show: | rex "rest/***/***"(?<method>\w+) \/rest\/(?<ActionTaken>.*)" AKA Action taken would be equal to apple, banana or structure Apple 1.0 or Banana 2 structure 2.0. (TLDR basically anything after rest/*/*/

tengugurl1 · ‎08-30-2024

I have a standard printed statement that shows something like this: [29/Aug/2024:23:59:48 +0000] "GET /rest/LMNOP [29/Aug/2024:23:59:48 +0000] "POST /rest/LMNOP [29/Aug/2024:23:59:48 +0000] "PUT /rest/LMNOP [29/Aug/2024:23:59:48 +0000] "DELETE /rest/LMNOP I don't have a defined field called "ActionTaken" in the sense, was the user doing a put, post or get etc.. Is there a simple regex that would give me something to add to a query that would define a variable called "ActionTaken" tried this: rex "\//rest/s*(?<ActionTaken>\d{3})" But it comes back with nothing

tengugurl1 · ‎08-21-2024

Hi! The log in question reads as: HTTP/1.1" 200 365 3 in our splunk, we don't have a "HTTP status" field to pivot off of.. So I see that the HTTP response always shows as it does above, So I'd need a regex that gives me something like: | rex field=HTTP response " HTTP/1.1" ***

Posts	3
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎08-21-2024

Online Status	Offline
Date Last Visited	‎09-03-2024 03:18 PM

Need help with a regex please. (Defining an action...

Easy question.. how do I get just the HTTP respons...

Re: Need help with a regex please. (Defining an ac...

Need help with a regex please. (Defining an action...

Easy question.. how do I get just the HTTP respons...