topic Re: Exclude path from URL in Search Results in Splunk Search

Exclude path from URL in Search Results

spfingst87 — Wed, 10 Nov 2021 00:43:31 GMT

I want to exclude the path from search results, i.e.:

www.testsite.com

www.testsite.com/path1

www.testsite.com/path2

www.testsite.com/path3

www.secondsite.com

www.secondsite.com/path1

From the above, all the sites are displaying in my search. I only want www.testsite.com and www.secondsite.com to show in search and rest of sites to be excluded.

Thanks.

Re: Exclude path from URL in Search Results

richgalloway — Wed, 10 Nov 2021 00:52:03 GMT

There probably are a few ways to do that. I'd use rex to extract the site from the URL.

... | rex field=url "(?<site>[^\/]+)"

Re: Exclude path from URL in Search Results

spfingst87 — Wed, 10 Nov 2021 00:59:06 GMT

Thanks for the fast response 🙂

I tried this and still the search is producing URL paths. In the site, do I need to put a variable?

As a note, there are around 50 URLs in my search and around 10 of them are displaying several paths each. So I am looking for as universal solution for any current or future URLs added to exclude the path (if that makes any sense :)) not just for 1 specific URL.

Thanks again!

Re: Exclude path from URL in Search Results

bowesmana — Wed, 10 Nov 2021 04:19:47 GMT

The suggested solution was for a field called url and it will extract a new field called site.

Depending on your data, replace 'url' with your input field and use the new field site for your analysis

Re: Exclude path from URL in Search Results

ITWhisperer — Wed, 10 Nov 2021 09:46:28 GMT

| regex _raw!="/"

Replace _raw with your field name if appropriate