https://community.splunk.com/t5/Splunk-Search/TLD-Extraction-for-Report/m-p/96201#M24852 <P>Looking for the same answer to this too. </P> Tue, 30 Jul 2013 20:55:38 GMT veryous 2013-07-30T20:55:38Z https://community.splunk.com/t5/Splunk-Search/TLD-Extraction-for-Report/m-p/96200#M24851 <P>I'm looking at creating a report that extracts suspicious TLDS over a period of time such as, as past six hours, or past twelve hours etc. Some of the TLD that I want to look at would be .ru, .ua or double like .rr.nu or cz.cc.</P> <P>I'm looking for a good way to extract the TLD from the URL and display that in a chart. I've seen a few regex's floating around but haven't had much luck modifying them into what I want to do.</P> <P>Thanks in advance</P> Tue, 16 Apr 2013 15:04:46 GMT https://community.splunk.com/t5/Splunk-Search/TLD-Extraction-for-Report/m-p/96200#M24851 TucoRameriz 2013-04-16T15:04:46Z https://community.splunk.com/t5/Splunk-Search/TLD-Extraction-for-Report/m-p/96201#M24852 <P>Looking for the same answer to this too. </P> Tue, 30 Jul 2013 20:55:38 GMT https://community.splunk.com/t5/Splunk-Search/TLD-Extraction-for-Report/m-p/96201#M24852 veryous 2013-07-30T20:55:38Z https://community.splunk.com/t5/Splunk-Search/TLD-Extraction-for-Report/m-p/96202#M24853 <P>Does anyone have the answer for this question? I'm looking for the same thing.</P> Wed, 15 Jul 2015 20:41:42 GMT https://community.splunk.com/t5/Splunk-Search/TLD-Extraction-for-Report/m-p/96202#M24853 phudinhha 2015-07-15T20:41:42Z https://community.splunk.com/t5/Splunk-Search/TLD-Extraction-for-Report/m-p/96203#M24854 <P>I am trying to use a erex with several examples to do the same thing.<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/4.1.5/SearchReference/Erex">http://docs.splunk.com/Documentation/Splunk/4.1.5/SearchReference/Erex</A></P> Mon, 03 Aug 2015 18:03:29 GMT https://community.splunk.com/t5/Splunk-Search/TLD-Extraction-for-Report/m-p/96203#M24854 Dallastek 2015-08-03T18:03:29Z https://community.splunk.com/t5/Splunk-Search/TLD-Extraction-for-Report/m-p/96204#M24855 <P>Try using this regex | rex "(?i)(?P.\w+)\d+.\w+\s+\d+\s+(?:/[^/]*){4}"</P> Mon, 03 Aug 2015 18:08:14 GMT https://community.splunk.com/t5/Splunk-Search/TLD-Extraction-for-Report/m-p/96204#M24855 Dallastek 2015-08-03T18:08:14Z