Hi,
I have this data
10.210.192.15 - - [26/Sep/2017:19:59:59 -0400] "POST /rest/icontrol/sites/315568/network/instances/100876ffe9572a.0/functions/disarm HTTP/1.1" 202 9 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "
10.210.192.5 - - [26/Sep/2017:19:59:59 -0400] "POST /rest/icontrol/sites/4793/network/instances/140024460000052928.10.0/functions/thermostatStatus HTTP/1.1" 202 9 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-" "-"
6:59:59.000 PM
10.210.192.15 - - [26/Sep/2017:19:59:59 -0400] "GET /rest/icontrol/sites/4793/network/lights/getAllLightingStatus HTTP/1.1" 202 9 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-" "-"
I need to extract out the numbers
315568
4793
and then I need to extract
disarm
thermostatStatus
getAllLightingStatus
I have the number extraction
rex "\/rest\/icontrol\/sites\/(?<number>\d+)"
but the other one I'm at a loss...... Any regex guru's to the rescue?
Thought I already did that one... ?
| rex "\/rest\/icontrol\/sites\/(?<number>\d+)\/(<myfield>[^\/\s]+)\sHTTP"
Thought I already did that one... ?
| rex "\/rest\/icontrol\/sites\/(?<number>\d+)\/(<myfield>[^\/\s]+)\sHTTP"
Hi DalJeanis,
You answered another one which was perfect! This one is a bit different.
I need to extract the last portion of the URL immediately before the HTTP. For example:
In the first event, I need to extract the word "disarm"