Want to extract only /ubi-v2/api/scoresummary
from the below mentioned event in a field.
Rex used:
`| rex "(?<remote_addr>[^\s]*) -(| ) (| )- \[(?<time_local>[^\]]*)\] \"(?<request>[^\"]*)\" (?<status>[^\s]*) (?<body_bytes_sent>[^\s]*)"
Event:
172.26.129.10 - - [16/Feb/2016:23:59:55 -0700] "GET /ubi-v1/api/ubidevicestatus?vin=1N4AL3AP3DC114528 HTTP/1.1" 500 1696
Don't need the entire "GET" Request,Tried using (GET[^\?]*)
but that does not get any results
Thanks for looking into this.
Try like this (run anywhere sample, first two lines are only to generate data, replace that with your base search)
| gentimes start=-1 | eval _raw="172.26.129.10 - - [16/Feb/2016:23:59:55 -0700] \"GET /ubi-v1/api/ubidevicestatus?vin=1N4AL3AP3DC114528 HTTP/1.1\" 500 1696" | table _raw
| rex "(?<remote_addr>[^\s]*)\s+\S+\s+\S+\s+\[(?<time_local>[^\]]*)\] \"(?<method>\S+)\s+(?<request>[^?\"\s]*).*\" (?<status>[^\s]*) (?<body_bytes_sent>[^\s]*)"
Try like this (run anywhere sample, first two lines are only to generate data, replace that with your base search)
| gentimes start=-1 | eval _raw="172.26.129.10 - - [16/Feb/2016:23:59:55 -0700] \"GET /ubi-v1/api/ubidevicestatus?vin=1N4AL3AP3DC114528 HTTP/1.1\" 500 1696" | table _raw
| rex "(?<remote_addr>[^\s]*)\s+\S+\s+\S+\s+\[(?<time_local>[^\]]*)\] \"(?<method>\S+)\s+(?<request>[^?\"\s]*).*\" (?<status>[^\s]*) (?<body_bytes_sent>[^\s]*)"