topic Extract Field URL in Splunk Search

Extract Field URL

erick_costa — Mon, 28 Sep 2020 13:47:37 GMT

How to do rex to extract field URL eg.: http://www.gnookcooki.com.br

alacercogitatus — Fri, 26 Apr 2013 12:38:09 GMT

your_search | rex field=_raw "(GET|POST|DELETE|PUT)\s*(?<url>[^\s]*)"

Although, this looks like access_combined, some items should be extracted for you already.

bmacias84 — Fri, 26 Apr 2013 15:32:45 GMT

Here another one that may work for you as well.
(?<uri>(https?|ftp)://[a-zA-Z0-9.\-_]+/[a-zA-Z0-9+&@#/%=~_\-|!:,.;]*)