https://community.splunk.com/t5/Splunk-Search/Extract-all-the-URl-s-present-in-the-log-into-a-field-and-count/m-p/387088#M167985 <P>Take a look at the URL Tool Box or the URL parser in splunkbase<BR /> URL Parser<BR /> <A href="https://splunkbase.splunk.com/app/3396/">https://splunkbase.splunk.com/app/3396/</A></P> <P>URL Toolbox<BR /> <A href="https://splunkbase.splunk.com/app/2734/">https://splunkbase.splunk.com/app/2734/</A></P> Tue, 07 Aug 2018 20:19:14 GMT dcharboneau_spl 2018-08-07T20:19:14Z https://community.splunk.com/t5/Splunk-Search/Extract-all-the-URl-s-present-in-the-log-into-a-field-and-count/m-p/387087#M167984 <P>I have couple of URL 's present in the logs . so I wanted to extract them all into a field ,but when I extract them I am also getting some unwanted data/false url for the field I have extracted . Following is my sample log entry.</P> <P>1.10.17.6 17.2.3.5 - - [07/Aug/2018:11:3:10 +0000] "POST /search/api/g6/group/get-groupname HTTP/1.1" 200 91 35 33</P> <P>so from the above log entry the endpoint is /search/api/g6/grp/get-grpname </P> Tue, 07 Aug 2018 15:57:35 GMT https://community.splunk.com/t5/Splunk-Search/Extract-all-the-URl-s-present-in-the-log-into-a-field-and-count/m-p/387087#M167984 navd 2018-08-07T15:57:35Z https://community.splunk.com/t5/Splunk-Search/Extract-all-the-URl-s-present-in-the-log-into-a-field-and-count/m-p/387088#M167985 <P>Take a look at the URL Tool Box or the URL parser in splunkbase<BR /> URL Parser<BR /> <A href="https://splunkbase.splunk.com/app/3396/">https://splunkbase.splunk.com/app/3396/</A></P> <P>URL Toolbox<BR /> <A href="https://splunkbase.splunk.com/app/2734/">https://splunkbase.splunk.com/app/2734/</A></P> Tue, 07 Aug 2018 20:19:14 GMT https://community.splunk.com/t5/Splunk-Search/Extract-all-the-URl-s-present-in-the-log-into-a-field-and-count/m-p/387088#M167985 dcharboneau_spl 2018-08-07T20:19:14Z