Getting Data In

How to resolve the parsing of key value pairs in a URL?

joepappano
New Member

I have log data that contains URLs like the example below. The automatic parsing of key value pairs works very well. All of the key value pairs after the question mark are parsed correctly, I see a field for every key after the question mark.

url=http://path/to/data.ext?Platform=val&AppName=val&AppVersion=val&AssetID=val&AssetType=val&MvpdID=val&IsPrimary=val&IsDR=val

The problem is that the query string in the URL field (everything before the ?) looks like the following. It always has the first key/value pair after the ?

http://path/to/data.ext?Platform=val

Trying to figure out the best way to make the URL field consistently have just the search string.
I've used a regex similar to this: | rex field=url mode=sed "s/\?.*//" Is there a better way?

Search head version 6.4.2

Hope this is enough info. Happy to provide more if needed.

0 Karma

sundareshr
Legend

If you only want the querystring (everything after the ?), try this

s/(.*)\?(.*)/\2/g

and for everything before the ?, use this

s/(.*)\?(.*)/\1/g
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...