https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-come-up-with-the-regex-to-get-the-domain-scheme/m-p/459663#M129725 <P>@jtotzek, glad it worked for you. Please accepts answer to close the thread</P> Tue, 06 Nov 2018 15:50:10 GMT renjith_nair 2018-11-06T15:50:10Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-come-up-with-the-regex-to-get-the-domain-scheme/m-p/459660#M129722 <P>Hi,</P> <P>I tried many things but I still cannot get to the correct result.</P> <P>my field value looks like this <BR /> <A href="http://34.223.245.254/path/user.html">http://34.223.245.254/path/user.html</A><BR /> <A href="http://sub.domain.com/D2-Client">http://sub.domain.com/D2-Client</A><BR /> <A href="https://sub.domain.ph">https://sub.domain.ph</A></P> <P>and in the output I just want <BR /> <A href="http://34.223.245.254">http://34.223.245.254</A><BR /> <A href="http://sub.domain.com">http://sub.domain.com</A><BR /> <A href="https://sub.domain.ph">https://sub.domain.ph</A></P> <P>so far it looks like this:</P> <PRE><CODE>BASE-SEARCH | rex field="MY_FIELD_NAME" "(REGEX)" | stats values("domain") </CODE></PRE> Tue, 06 Nov 2018 11:28:55 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-come-up-with-the-regex-to-get-the-domain-scheme/m-p/459660#M129722 jtotzek 2018-11-06T11:28:55Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-come-up-with-the-regex-to-get-the-domain-scheme/m-p/459661#M129723 <P>@jtotzek,</P> <P>Give this a try and see if it works,</P> <PRE><CODE>|rex field=YOUR_FIELD_NAME "(?&lt;domain&gt;https?:\/\/[^\/]+)" </CODE></PRE> Tue, 06 Nov 2018 12:00:20 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-come-up-with-the-regex-to-get-the-domain-scheme/m-p/459661#M129723 renjith_nair 2018-11-06T12:00:20Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-come-up-with-the-regex-to-get-the-domain-scheme/m-p/459662#M129724 <P>wow, perfect! I was almost there! thanks a lot!</P> Tue, 06 Nov 2018 12:45:15 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-come-up-with-the-regex-to-get-the-domain-scheme/m-p/459662#M129724 jtotzek 2018-11-06T12:45:15Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-come-up-with-the-regex-to-get-the-domain-scheme/m-p/459663#M129725 <P>@jtotzek, glad it worked for you. Please accepts answer to close the thread</P> Tue, 06 Nov 2018 15:50:10 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-come-up-with-the-regex-to-get-the-domain-scheme/m-p/459663#M129725 renjith_nair 2018-11-06T15:50:10Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-come-up-with-the-regex-to-get-the-domain-scheme/m-p/459664#M129726 <P>@jtotzek, do you have any other question on this ? If not, kindly accept as answer .</P> Thu, 15 Nov 2018 10:05:48 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-come-up-with-the-regex-to-get-the-domain-scheme/m-p/459664#M129726 renjith_nair 2018-11-15T10:05:48Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-come-up-with-the-regex-to-get-the-domain-scheme/m-p/459665#M129727 <P>You can try -</P> <PRE><CODE>BASE-SEARCH | erex _raw url "http://34.223.245.254,http://sub.domain.com,https://sub.domain.ph" </CODE></PRE> <P>Under Job you should see the generated regex...</P> Thu, 15 Nov 2018 14:42:47 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-come-up-with-the-regex-to-get-the-domain-scheme/m-p/459665#M129727 ddrillic 2018-11-15T14:42:47Z