Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Extract Fields Using RegEx

$
0
0

I am having trouble trying to parse data from a raw event line.

The raw event come in 2 different ways further below using the following regex info

(?i)^(?:[^^]*^){2}(?P<bannerid>[^^]+)

The issue is some have ^ and others %5E is there a way to capture both in the extraction?

[30/Jan/2014:04:59:58 +0000] "GET /t25f.png?Starcom_CrystalLight_CrystalLight_BS_Visor1_3023150_5184568%5E5184568%5E23255909%5E3098598 HTTP/1.1" 200 h://cms.springboard.gorillanation.com/embed_iframe/1085/video/854883/tjbr001/thejasminebrand.com/10"

&

[30/Jan/2014:04:59:59 +0000] "GET /s75t.png?Starcom_ChrystalLight_ChrystalLight_CU_Visor1_3023150_5170050^5170050^23244639^2844787^^NoOfSlates=1^CurrentSlate=1 HTTP/1.1" 200 h://www.pch.com/entryintervid?crmN=2014JanTVPC1En"

Thanks you all for any help.


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>