Splunk Search

Extracting File Names from URL String

TucoRameriz
Explorer

Hello All,

Having some trouble coming up with a way to extract a file with three random characters and a .jnlp extension from the URI.

Here is what I've attempted to so far. Any assistance would be greatly appreciated.

index=wsa .jnlp | rex field=csurl (?) | regex csurl="\/[a-z0-9]{3}.jnlp$"
Tags (1)
0 Karma

TucoRameriz
Explorer

I was looking to extract only JNLP files with a three character file name 123.jnlp or abc.jnlp

Thanks

0 Karma

TucoRameriz
Explorer

Thanks for the reply. The one question I have is in regards to the new field? Rex field extraction is not one of my strong points yet. Do I just give it a random name?

Thanks

0 Karma

krugger
Communicator

Wasn't that what you required? Give an input and expected output example

0 Karma

kristian_kolb
Ultra Champion

but of course, that's what you're searching for.

You could add a | search file_extract=* at the end, which requires that the field exists, regardless of its value, The field will not be set if the rex does not match.

/k

0 Karma

TucoRameriz
Explorer

Gave it a try and this string returns all .jnlp files.

index=wsa cs_url=*.jnlp | rex field=cs_url "(?\w{3}).jnlp$"

Any thoughts

0 Karma

kristian_kolb
Ultra Champion

Well. Perhaps not random, but more or less arbitrary. Some hints, though:
- Use underscores instead of hyphens.
- Must not start with a number.
- Pick a name that makes sense.

Remember that you can always change a field extraction later, but...if you do, you'll have to alter all tags, eventtypes, saved searches etc that uses the (old) field name.

So if you have another log file that you want to correlate with, it could be a good idea to use the same field name here, e.g. a client ip address could/should always be extracted as clientip, regardless of generating system.

0 Karma

kristian_kolb
Ultra Champion

If you have the field csurl already defined, something like this should work.

index=wsa csurl=*.jnlp | rex field=csurl "(?<my_new_field>\w{3})\.jnlp$"

If the filename (excluding the extension) is shorter than 3 - the field extraction will fail. If the filename (excluding extension) is longer than 3 - only the last 3 will be extracted into the new field.

/k

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...