In my logs I have different url and i need to fins a smart way to get the base_url.
The urls are:
Can I use a single regexp to do that ?
Now I use something like this but I don't think that is the right way
| eval a=split(URL,"?")|eval URL=mvindex(a,0)
| rex field=URL "(?<base_url>.*AccountOpenings/v[0-9]).*"
| eval URL=if(match(URL,"AccountOpenings" ),base_url,URL)
Try something like this
| rex field=URL "(?<base_url>.+(\/v[0-9]|AccountOpenings|(?=\?)))"
Try something like this
| rex field=URL "(?<base_url>.+(\/v[0-9]|AccountOpenings|(?=\?)))"
Thank you for the solution. It helps me a lot.
It seems that that the url ended in "/" it's not treated but I will try to find a solution