Splunk Search

Another regex

dbcase
Motivator

Hi,

I have this data

10.210.192.15 - - [26/Sep/2017:19:59:59 -0400] "POST /rest/icontrol/sites/315568/network/instances/100876ffe9572a.0/functions/disarm HTTP/1.1" 202 9 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "

10.210.192.5 - - [26/Sep/2017:19:59:59 -0400] "POST /rest/icontrol/sites/4793/network/instances/140024460000052928.10.0/functions/thermostatStatus HTTP/1.1" 202 9 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-" "-"

6:59:59.000 PM

10.210.192.15 - - [26/Sep/2017:19:59:59 -0400] "GET /rest/icontrol/sites/4793/network/lights/getAllLightingStatus HTTP/1.1" 202 9 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-" "-"

And I think I need to do a backwards match (unless there is a better way). I need to match

disarm in the first event
thermostatStatus in the second event
getAllLightingStatus in the third event

I'm ok with regex but trying to wrap my mind around how to search backwards throws me for a loop!

Tags (2)
0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

Nothing backwards about it. We want a chunk that occurs between a slash "/" and the letters " HTTP". We want to make sure not to match the space \s or any other slashes \/.

Thus, we create a character type that matches anything but slash or whitespace [^\/\s], and capture however many of them there are, (but minimum one +) between our endpoints.

   | rex "\/(?<mymatch>[^\/\s]+)\sHTTP"

Voila.

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Nothing backwards about it. We want a chunk that occurs between a slash "/" and the letters " HTTP". We want to make sure not to match the space \s or any other slashes \/.

Thus, we create a character type that matches anything but slash or whitespace [^\/\s], and capture however many of them there are, (but minimum one +) between our endpoints.

   | rex "\/(?<mymatch>[^\/\s]+)\sHTTP"

Voila.

0 Karma

dbcase
Motivator

wow, that is pretty slick

DalJeanis
SplunkTrust
SplunkTrust

@dbcase - It's all in learning how to look at it. Sometimes you just have to take three steps back. Sometimes you have to cross your eyes. Sometimes you have to get out a chainsaw and cut a wall out of the way. 😉

0 Karma

dbcase
Motivator

I can't wait to use the chainsaw! 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...