https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-extract-the-domain-name/m-p/352409#M104307 <P>I tried, its not working</P> Mon, 13 Mar 2017 14:30:32 GMT kiran331 2017-03-13T14:30:32Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-extract-the-domain-name/m-p/352407#M104305 <P>Hi, </P> <P>How to write a regular expression to use to extract the domain name from the dest_host, like extracting the last character before second "."<BR /> for example:<BR /> stg-ec-ore-u.uplynk.com <BR /> 7.tlu.dl.delivery.mp.microsoft.com<BR /><BR /> stg-ec-norcal-u.microsoft.com<BR /><BR /> foxnews-f.akamaihd.net<BR /><BR /> cnnios-f.akamaihd.net<BR /><BR /> daarack02.vpg.cdn.yimg.com<BR /><BR /> redir.adap.tv</P> <P>Required Output:<BR /> .uplynk.com <BR /> .microsoft.com<BR /><BR /> .akamaihd.net<BR /><BR /> .yimg.com<BR /> .adap.tv</P> Mon, 13 Mar 2017 14:17:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-extract-the-domain-name/m-p/352407#M104305 kiran331 2017-03-13T14:17:26Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-extract-the-domain-name/m-p/352408#M104306 <P>Try like this</P> <P><STRONG>Updated</STRONG></P> <PRE><CODE>your search | rex field=dest_host "(?&lt;domain&gt;\.[A-z0-9]+\.[A-z0-9]+)$" </CODE></PRE> Mon, 13 Mar 2017 14:22:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-extract-the-domain-name/m-p/352408#M104306 somesoni2 2017-03-13T14:22:30Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-extract-the-domain-name/m-p/352409#M104307 <P>I tried, its not working</P> Mon, 13 Mar 2017 14:30:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-extract-the-domain-name/m-p/352409#M104307 kiran331 2017-03-13T14:30:32Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-extract-the-domain-name/m-p/352410#M104308 <P>try this:</P> <PRE><CODE>rex field=dest_host "[^\.]+(?&lt;domain&gt;.+)" </CODE></PRE> Mon, 13 Mar 2017 14:34:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-extract-the-domain-name/m-p/352410#M104308 asimagu 2017-03-13T14:34:21Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-extract-the-domain-name/m-p/352411#M104309 <P>Missed a + sign at the end. Try the updated answer.</P> Mon, 13 Mar 2017 14:35:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-extract-the-domain-name/m-p/352411#M104309 somesoni2 2017-03-13T14:35:55Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-extract-the-domain-name/m-p/352412#M104310 <P>Thanks somesoni2! It worked, is there a way to remove . before domain name.</P> Mon, 13 Mar 2017 14:57:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-extract-the-domain-name/m-p/352412#M104310 kiran331 2017-03-13T14:57:53Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-extract-the-domain-name/m-p/352413#M104311 <P>Just remove the <CODE>\.</CODE> after <CODE>&lt;domain&gt;</CODE>. A more accurate version would be like this</P> <PRE><CODE>your search | rex field=dest_host "\.(?&lt;domain&gt;[A-z0-9]+\.[A-z0-9]+)$" </CODE></PRE> Mon, 13 Mar 2017 15:06:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-regular-expression-to-extract-the-domain-name/m-p/352413#M104311 somesoni2 2017-03-13T15:06:31Z