Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to extract a text from a field

$
0
0
Hi All I have a field which has urls in this pattern GET /echo/index?page=content&id=PRO19579&viewlocale=es_ES HTTP/1.1 GET /echo/index?page=relatedLinks&id=PRD1296&viewLocale=null&channel=REFERENCE&_=1454507716347 HTTP/1.1 I have to extract only the part between 'page' and '&' ie 'content' and 'relatedLinks' from it. I tried to extract it using substr and rtrim but I am unable to trim contents after &. My search string is | eval URL = substr(field7,17) | eval URL = rtrim(URL,"^\\&.*") After using substr my result is page=content&id=PRO19579&viewlocale=es_ES HTTP/1.1 page=relatedLinks&id=PRD1296&viewLocale=null&channel=REFERENCE&_=1454507716347 HTTP/1.1 But the rtrim function is not at all working to remove the text with and after &. Please help.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>