topic Re: How to extract a URL from a text string and assign it to a variable in Splunk? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-URL-from-a-text-string-and-assign-it-to-a/m-p/264079#M79270 <P>Need a sample log entry</P> Thu, 01 Sep 2016 16:46:39 GMT twinspop 2016-09-01T16:46:39Z How to extract a URL from a text string and assign it to a variable in Splunk? https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-URL-from-a-text-string-and-assign-it-to-a/m-p/264078#M79269 <P>I cannot find a working example of this anywhere. I can find examples a mile long on google, but am having trouble actually assigning them to a variable in Splunk.</P> Thu, 01 Sep 2016 16:42:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-URL-from-a-text-string-and-assign-it-to-a/m-p/264078#M79269 Cuyose 2016-09-01T16:42:40Z Re: How to extract a URL from a text string and assign it to a variable in Splunk? https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-URL-from-a-text-string-and-assign-it-to-a/m-p/264079#M79270 <P>Need a sample log entry</P> Thu, 01 Sep 2016 16:46:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-URL-from-a-text-string-and-assign-it-to-a/m-p/264079#M79270 twinspop 2016-09-01T16:46:39Z Re: How to extract a URL from a text string and assign it to a variable in Splunk? https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-URL-from-a-text-string-and-assign-it-to-a/m-p/264080#M79271 <P>http or https <BR /> then ://<BR /> then anything up to .<BR /> then anything up to .<BR /> then anything up to first /</P> Thu, 01 Sep 2016 17:00:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-URL-from-a-text-string-and-assign-it-to-a/m-p/264080#M79271 Cuyose 2016-09-01T17:00:56Z Re: How to extract a URL from a text string and assign it to a variable in Splunk? https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-URL-from-a-text-string-and-assign-it-to-a/m-p/264081#M79272 <P>Try this, for 3 capturing groups. You can name each group, if desired.</P> <PRE><CODE>... | rex "https?:\/\/([^\.]+)\.([^\.]+)\.([^\/]+)" </CODE></PRE> Thu, 01 Sep 2016 17:05:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-URL-from-a-text-string-and-assign-it-to-a/m-p/264081#M79272 sundareshr 2016-09-01T17:05:10Z Re: How to extract a URL from a text string and assign it to a variable in Splunk? https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-URL-from-a-text-string-and-assign-it-to-a/m-p/264082#M79273 <P>I got what I needed using the following:</P> <PRE><CODE>|rex field=_raw "(?(https?:\/\/([-\w\.]+)+(:\d+)?))" </CODE></PRE> Thu, 01 Sep 2016 17:08:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-URL-from-a-text-string-and-assign-it-to-a/m-p/264082#M79273 Cuyose 2016-09-01T17:08:03Z