topic Re: Regex first part of the URL in Splunk Search

Is there a way to regex first part of the URL?

ebs — Fri, 28 Apr 2023 13:49:57 GMT

Hi,

All my URLs have this general format https://value.company.com.au/etc/ Is there a way I can extract URLs and always stop at the .au but also have this included in the field? Some differ with a port at the end so its goes https://value.company.com.au:9001 but I don't want the port or anything after the /.

Do you have any recommendations on what the regex would look like?

Re: Regex first part of the URL

ITWhisperer — Mon, 03 May 2021 23:11:02 GMT

(?<url>https?:\/\/[^:\/]+)

Re: Regex first part of the URL

ebs — Tue, 04 May 2021 05:44:55 GMT

Thanks so much!

Re: Regex first part of the URL

Badab — Thu, 27 Apr 2023 17:36:22 GMT

Hello,

Thanks for that, but it not works on my Splunk research, I get the following message :

Error in 'SearchParser': Missing a search command before '^'. Error at position '86' of search query 'search index=* sourcetype="os_win_wks:java:trace" ...{snipped} {errorcontext = tps?:\/\\[^:\/]+)}'.

Do you know why ?

Thanks

Re: Regex first part of the URL

ITWhisperer — Thu, 27 Apr 2023 18:45:52 GMT

Because you are not using it to extract the field correctly. Rather than trying to extend someone else's question, please ask a fresh question where you can define your usecase more fully.