I have the below sample data, and I want to extract everything after the service URL till maxd=60&mind=60
into a new field called service
.
I have used (?i) url: (?P.+?)\w+= but it is not extracting completly
31 Jan 2018 20:22:13 [INFO ] AD Transaction: timestamp: 1513204259, transactionID: 2899739, reqID: 3022368026, uuid: 72dca744-b342-4aac-9861-005056b21335, type: ad request, transaction: start, service url: http://mrm.mdc.time.com/ad/p/1?nw=376521&mode=live&vdur=600&flag=+sltp+amsl+ssus+amcb+dtrd&metr=1031..., client url: http://mmdai-linear-west-01.time.com
try this also:
...| rex "(?i)service url:\s*(?<service>.*)&maxd=60&mind=60"
hey try this run anywhere search
| makeresults
| eval _raw="31 Jan 2018 20:22:13 [INFO ] AD Transaction: timestamp: 1513204259, transactionID: 2899739, reqID: 3022368026, uuid: 72dca744-b342-4aac-9861-005056b21335, type: ad request, transaction: start, service url: http://mrm.mdc.time.com/ad/p/1?nw=376521&mode=live&vdur=600&flag=+sltp+amsl+ssus+amcb+dtrd&metr=1031..., client url: http://mmdai-linear-west-01.time.com";
| rex field=_raw "service\surl\:\s+(?<service_URL>.*)&maxd=60&mind=60"
In your environment, you should write
<base_search> | rex field=_raw "service\surl\:\s+(?<service_URL>.*)&maxd=60&mind=60"
let me know if this helps!
try this also:
...| rex "(?i)service url:\s*(?<service>.*)&maxd=60&mind=60"
This helped,made some changes to it..Thanks
How about trying this:
your query to return events
| rex "service url:\s*(?<service>.*)&maxd=60&mind=60"
| table service
see extraction here