https://community.splunk.com/t5/Splunk-Search/extract-domain-from-field/m-p/170675#M48844 <P>try the updated one.</P> Fri, 28 Feb 2014 21:40:33 GMT somesoni2 2014-02-28T21:40:33Z https://community.splunk.com/t5/Splunk-Search/extract-domain-from-field/m-p/170672#M48841 <P>Could someone help me with a rex to extract the domain out of a http or https URL? For example, I need '<A href="http://www.test.com">www.test.com</A>' to be extracted from each of the following:</P> <P>http ://<A href="http://www.test.com?id=6">www.test.com?id=6</A><BR /><BR /> http ://<A href="http://www.test.com/6/7">www.test.com/6/7</A><BR /><BR /> https ://<A href="http://www.test.com">www.test.com</A> </P> Fri, 28 Feb 2014 20:18:21 GMT https://community.splunk.com/t5/Splunk-Search/extract-domain-from-field/m-p/170672#M48841 foreright360 2014-02-28T20:18:21Z https://community.splunk.com/t5/Splunk-Search/extract-domain-from-field/m-p/170673#M48842 <P>Hello,<BR /> Try this</P> <PRE><CODE>search.. |rex field=Field_name "\/\/(?&lt;URL&gt;\\w+[\\.\\w]+)"|table URL </CODE></PRE> <P>Thanks</P> <P>Updated:</P> <PRE><CODE>search.. |rex field=Field_name "\/\/(?&lt;URL&gt;\\w+[\\.-\\w]+)"|table URL </CODE></PRE> Fri, 28 Feb 2014 20:32:27 GMT https://community.splunk.com/t5/Splunk-Search/extract-domain-from-field/m-p/170673#M48842 linu1988 2014-02-28T20:32:27Z https://community.splunk.com/t5/Splunk-Search/extract-domain-from-field/m-p/170674#M48843 <P>Works great except for domains with a '-' in it.</P> Fri, 28 Feb 2014 21:27:05 GMT https://community.splunk.com/t5/Splunk-Search/extract-domain-from-field/m-p/170674#M48843 foreright360 2014-02-28T21:27:05Z https://community.splunk.com/t5/Splunk-Search/extract-domain-from-field/m-p/170675#M48844 <P>try the updated one.</P> Fri, 28 Feb 2014 21:40:33 GMT https://community.splunk.com/t5/Splunk-Search/extract-domain-from-field/m-p/170675#M48844 somesoni2 2014-02-28T21:40:33Z