topic Re: Remove everything after .com in website in Splunk Search

Remove everything after .com in website

N5535 — Wed, 14 Apr 2021 02:22:36 GMT

Is there a simple way to remove everything after website.com

Currently I have several urls imported into splunk, some of which has full paths following .com

Currently:	Would like it to be:
firstwebsite.com/website	firstwebsite.com
secondwebsite.com	secondwebsite.com
thirdwebsite.com/jigiiit/jjejjrejr	thirdwebsite.com
fourthwebsite.com/hjeh	fourthwebsite.com

Any pointers would be great!

scelikok — Wed, 14 Apr 2021 04:55:26 GMT

Please try below;

| rex field=url_field "^(?<cleaned_url>[^\/]+)" | table url_field cleaned_url

N5535 — Wed, 14 Apr 2021 17:49:36 GMT

I should have mentioned that there is https:// in front of the url's.

My results are

https://

mayurr98 — Wed, 14 Apr 2021 18:58:29 GMT

try this:

| rex field=url_field "http(|s):\/\/(?<url>[^\/]+)"