Splunk Search

Extracting the end of a URL

jravida
Communicator

Hi folks,

I was wondering if there is a quick way to extract the end of a URL (within the URI portion) and put it in a field.

www.example.com/2014/05/15/world/africa/sudan-christian-woman-apostasy/index.html
www.example.com/test/sudan-christian-woman-apostasy/test.zip

So I would only want index.html and test.zip to show up in a new field.

Hope this is easy to do, it probably is.

Tags (1)
0 Karma
1 Solution

linu1988
Champion

Try this

| rex field=fiels_name "\/(?<File>\\w+\\.\\w+)"

Thanks

View solution in original post

linu1988
Champion

Try this

| rex field=fiels_name "\/(?<File>\\w+\\.\\w+)"

Thanks

jravida
Communicator

This works perfect. Thanks for taking the time!

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...