Extract only host name from the URL field-

yat135 — Fri, 20 Nov 2020 08:36:29 GMT

Hi,

I have a field "blockedUri" which can contain two types of value (string or URL). Below is an example :

blockedUri = eval

blockedUri = https://analytics.google.com/sample.js

I need a splunk search query that will trim and return the only hostname of the value if it's a URL or if it is a normal string simply return the string.

The result should be as below :

eval

analytics.google.com

Thanks in advance

Re: Extract only host name from the URL field-

ITWhisperer — Fri, 20 Nov 2020 08:36:53 GMT

| rex field=blockURL "http(s):\/\/(?<hostname>[^\/]+)" | eval result=coalesce(hostname,blockedURL)

topic Re: Extract only host name from the URL field- in Splunk Enterprise Security

Extract only host name from the URL field-

Re: Extract only host name from the URL field-