Splunk Search

Extract string between 2 string

serviceinfrastr
Explorer

Hi Community,

I have a question about regex and extraction

I want to extract only the string between /var/log/nginx/access_ and .log

alt text

I already tried many regex en mod=sed but i don't find the right regex.

Can you help me ?

Many thanks

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If you just need to extract a string then you don't need sed as that is for modifying strings.
Try this:

host=dnginx* NOT source="/var/log/nginx/access.log" NOT source="/var/log/nginx/error.log" | rex field=source "access_(?<string>[^\.]+)" | chart count by string | rename url_short as URL
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

Hi @serviceinfrastructure - Did your answer provide a working solution to your question? If yes, don't forget to click "Accept" to close out your question so that others can easily find it if they are having the same issue. Thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you just need to extract a string then you don't need sed as that is for modifying strings.
Try this:

host=dnginx* NOT source="/var/log/nginx/access.log" NOT source="/var/log/nginx/error.log" | rex field=source "access_(?<string>[^\.]+)" | chart count by string | rename url_short as URL
---
If this reply helps you, Karma would be appreciated.
0 Karma

sudosplunk
Motivator

Try this. Add this to your search,

search...| rex field=source "\/var\/log\/nginx\/access\_(?<string>\S+)\.log" | table string

Tested regex here.

0 Karma

sudosplunk
Motivator

@serviceinfrastructure ,

You can use regex given by @richgalloway, as it takes, 13 steps to match the pattern and mine takes 38 steps. However, if you have many sources with access_ in the value, then you might want to be more specific in defining regex.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@serviceinfrastructure,

Try

 |rex  field=URL "^/\w+/\w+/\w+/\w+_(?P<my_string>[^\.]+)"|table my_string
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...