topic Re: Get domain name from urls in Splunk Search

Get domain name from urls

Sagarvadlamani — Sun, 14 Jun 2020 06:54:53 GMT

Hello,

I'm trying get the domain name alone from any given urls. Please see the list of url formats i'm dealing with and how i want the result to be.

https://www.example.com:9090 https://abc.example-url.uk/username/test https://test-url.web-url.ch/test https://hello.example.co?test https://test.example.com,

Expected output for the URL field as follows

www.example.com abc.example-url.uk test-url.web-url.ch hello.example.co test.example.com

I tried the following rex

rex "Value1=https://(?P<URL>([\w]+\.[\w]+\.[\w]+))"

The above won't pull anything like abc.example-url.uk or test-url.web-url.ch. Looks like i'm missing something here. Can anyone please help.

Re: Get domain name from urls

gcusello — Sun, 14 Jun 2020 08:08:18 GMT

Hi @Sagarvadlamani ,

try this regex:

https:\/\/(?<domain>[^:\/\?,]*)

that you can test at https://regex101.com/r/7XmpL4/1

Ciao.

Giuseppe

Re: Get domain name from urls

to4kawa — Sun, 14 Jun 2020 08:51:35 GMT

https://community.splunk.com/t5/forums/searchpage/tab/message?advanced=false&filter=location&q=url%20rex&q=URL%20Rex&location=category:en-us&allow_punctuation=false

Why not check first?

Re: Get domain name from urls

Sagarvadlamani — Sun, 14 Jun 2020 21:20:21 GMT

Thank you @gcusello . It worked.