When I run my Splunk query, I get url field and the value of the field is like this
https://location-server-aks-611ab294.test.australia.azm.io:443/api
I would like to extract the words "location" and "server" from the above value. How can I accomplish this ?
If they'll always be in the same place in the string, and will always be delimited by dashes...
mysearch | rex "https:\/\/(?<first_string>[^-]*)-(?<second_string>[^-]*)"
That will retrieve the aptly named "first_string" and "second_string" from the first two '-' delimited things in the url after https.
A variation of that can be put in props to extract it always. For that, look at EXTRACT- or REPORT- props settings from the props.conf spec file