topic Re: Excluding a specific URL in Regex in Splunk Search

Excluding a specific URL in Regex

SplunkNewbie18 — Mon, 22 Jan 2018 06:05:11 GMT

Hi,

I read through forums on how to extract URLs using regex. But couldn't find those on how to exclude them.

For example, how do I extract all domain except for "google.com.sg".

Thanks!

Re: Excluding a specific URL in Regex

Sukisen1981 — Mon, 22 Jan 2018 13:03:37 GMT

it will help if you can share your query wherein you are able to extract the url.
Also, what all urls do you want to exclude? Is it just one or do you have a list ?

Re: Excluding a specific URL in Regex

nickhills — Mon, 22 Jan 2018 13:15:12 GMT

If I understand what you want - you will still will need to extract the 'google.com.sg' url, but you may want to exclude it from your search.

You should be able to use != so assuming the extraction is called 'url':

<your existing search> url!=google.com.sg*|<etc..>

Re: Excluding a specific URL in Regex

horsefez — Mon, 22 Jan 2018 14:40:02 GMT

Hey,

so you particularely asked about removing it via the use of regular expression.
Let me give you an example:

google.com
google.com.sg
facebook.com
splunk.com
answers.splunk.com
idontknowanyurlsanymore.ru
iamahorseandilikeit.horse.me
factor.io

I've built a regular expression using a negative lookahead (?!...) to exclude the url from matching.
^(?!google\.com\.sg)(?<url>[^\n]+)(?:\n|)

https://regex101.com/r/wQ74EI/1

Let me know if you need additional help and/or explanation.

Cheers!

Re: Excluding a specific URL in Regex

SplunkNewbie18 — Thu, 25 Jan 2018 07:53:07 GMT

Hi!

Yes, it works and this is what I wanted. Many thanks! 🙂