I have the below line :
Parameters: {"referrer"=>"http://www.xxxxx.net/transport_deeplink/4.0/EE/en-gb/EUR
and I want to use a regex command (rex field=_raw) in order to count them by:
domain: http://www.xxxxx.net
country: EE
language: en-gb
currency: EUR
Can please someone help me with this?
If the structure is always the same, this should work:
\=\>\"(?<domain>http:\/\/[^\/]+)(?:\/[^\/]+){2}\/(?<country>[^\/]+)\/(?<language>[^\/]+)\/(?<currency>[^\/]+)
Place it in your rex
like this:
... | rex field=_raw "\=\>\"(?<domain>http:\/\/[^\/]+)(?:\/[^\/]+){2}\/(?<country>[^\/]+)\/(?<language>[^\/]+)\/(?<currency>[^\/]+)" | ...
PS: you should check/develop your regexes with something like https://regex101.com/, it actually makes regex fun 🙂
If the structure is always the same, this should work:
\=\>\"(?<domain>http:\/\/[^\/]+)(?:\/[^\/]+){2}\/(?<country>[^\/]+)\/(?<language>[^\/]+)\/(?<currency>[^\/]+)
Place it in your rex
like this:
... | rex field=_raw "\=\>\"(?<domain>http:\/\/[^\/]+)(?:\/[^\/]+){2}\/(?<country>[^\/]+)\/(?<language>[^\/]+)\/(?<currency>[^\/]+)" | ...
PS: you should check/develop your regexes with something like https://regex101.com/, it actually makes regex fun 🙂
Thank you very much jeff it worked perfect!
I would check https://regex101.com/, but do you have any sites/sources that have dictionary or anything else that would help me learn how to use the regex from the start?
I would like to learn how to use those commands: "\/\/[^\/]+"! At the time being I know/understand only the basic structure like:
\d
\D
\w
\W
http://www.regexr.com/ is sometimes helpful with more explicit explanations when looking at specific regexes, but http://www.regular-expressions.info/ is IMHO the best source for more general explanations.
Also, please post regexes as code here on splunk answers - otherwise the markup will mess them up.
Thank you again jeffland,
What do you mean by: "Also, please post regexes as code here on splunk answers - otherwise the markup will mess them up" ?
Do you mean the tag I used for the question?
Have a look at the buttons above the text editor - you'll see one for bold, italic and eventually one for marking stuff as code. Please use it on regexes, otherwise they will look like they do in your previous posts (e.g. backslashes can get lost, angular brackets and their content are dropped etc).
Alternatively, start such phrases which contain special characters (e.g. regexes) with an acute accent () and close it with the same character again which will yield
something like this`, or leave one line empty and indent the next one by four spaces
which will yield this (better for longer code)
Got it! Thank you very much for your advice's Jeff I will keep in mind the code-button next time I will post here.