https://community.splunk.com/t5/Splunk-Search/How-to-extract-domain-and-top-level-domain/m-p/623913#M216910 <LI-CODE lang="markup">| rex field=queryField ".*\.(?&lt;extractedField&gt;\w+\.\w+)"</LI-CODE> Sun, 11 Dec 2022 09:01:51 GMT ITWhisperer 2022-12-11T09:01:51Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-domain-and-top-level-domain/m-p/623912#M216909 <P>Dears</P> <P>&nbsp;</P> <P>&nbsp;I need your help in extracting the domain and top level domain from dns queries where:</P> <P>&nbsp;</P> <P>Query Field&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;extracted field</P> <P>Account.fb.com&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Fb.com</P> <P>Aa.bb.cc.com&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Cc.com</P> <P><A href="http://Www.google.com&nbsp;" target="_blank" rel="noopener">Www.google.com&nbsp;</A> &nbsp; &nbsp; .&nbsp; &nbsp; &nbsp; &nbsp; Google.com</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>Thanks in advance&nbsp;</P> Mon, 12 Dec 2022 15:07:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-domain-and-top-level-domain/m-p/623912#M216909 moayadalghamdi 2022-12-12T15:07:19Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-domain-and-top-level-domain/m-p/623913#M216910 <LI-CODE lang="markup">| rex field=queryField ".*\.(?&lt;extractedField&gt;\w+\.\w+)"</LI-CODE> Sun, 11 Dec 2022 09:01:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-domain-and-top-level-domain/m-p/623913#M216910 ITWhisperer 2022-12-11T09:01:51Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-domain-and-top-level-domain/m-p/623914#M216911 <LI-CODE lang="markup">| eval extractedField=mvjoin(mvindex(split(queryField,"."),-2,2),".")</LI-CODE> Sun, 11 Dec 2022 09:04:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-domain-and-top-level-domain/m-p/623914#M216911 ITWhisperer 2022-12-11T09:04:07Z