Splunk Search

Regex for digits before .zip

jacqu3sy
Path Finder

Hi,

How do I write a regex to capture whenever I see any combination of 10 digits followed by .zip within a _raw event?

eg:

url=www.abcdef.com/1234532419.zip

Thanks.

Tags (2)
0 Karma
1 Solution

vnravikumar
Champion

Try like

| rex field=url "\/(?P<result>\d{10}.zip)"

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

... | rex field=url mode=sed "s/\.zip//"
0 Karma

vnravikumar
Champion

Try like

| rex field=url "\/(?P<result>\d{10}.zip)"
0 Karma

jacqu3sy
Path Finder

ah yeh, how would I capture the whole URL though in the new result field? rather than just the 6 digits?

0 Karma

vnravikumar
Champion

what is your expected result?

0 Karma

jacqu3sy
Path Finder

Expected result is the full URL listed, but to only pull back URL's that match the regex, i.e. 10 digits followed by .zip

url=www.abcdef.com/1234532419.zip

0 Karma

vnravikumar
Champion

Check this rex (?P<result>url=\S+\/\d{10}.zip)

0 Karma

jacqu3sy
Path Finder

Perfect. Many thanks 🙂

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jacqu3sy

Try this:

YOUR SEARCH | rex field=url "(?<data>\d.*).zip"

Sample

|makeresults | eval url="www.abcdef.com/1234532419.zip" | rex field=url "(?<data>\d.*).zip"

jacqu3sy
Path Finder

ah yeh, how would I capture the whole URL though in the new data field? rather than just the 6 digits?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...