Splunk Search

Help with regex to extract a string?

Pramodkuber
Engager

Need to fetch API name from URL.
e.g. base_url/products_support/system_name/api-name?parameters

Here I need to fetch "system_name/api-name" string between "product_support" and "?".

Any inputs which regex needs to use here?

0 Karma

woodcock
Esteemed Legend

Like this:

| rex field=YourFieldHere "(?<base_url>[^\/?]+)\/(?<producst_support>[^\/?]+)\/(?<system_name>[^\/?]+)\/(?<api_name>[^\/?]+)?(?<parameters>.*)$"

Pramodkuber
Engager

Thanks a lot for your inputs. This is really very helpful. But I have few URLs where parameters are coming in path instead of queryparams.
How to take care of that? any idea?

e.g.
v2/customers/{customerID}/tickets
v2/customers/123456/tickets
v2/customers/987654/tickets

When I use "| stats values(api_name)" I am getting very big list as customer ID are different. I am looking result for 2/customers//tickets
"
" should take care of all dynamic values for customer Ids and " stats values(api_name)" sjoul return only one row for "v2/customers/*/tickets"

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...