https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-extract-URL-information-from-logs/m-p/278125#M83947 <P>Something link this:</P> <P>rex field=_raw "(?https?:\/\/[\da-z.-]+.[a-z.]{2,6}[\/\w .-]*)" </P> Fri, 16 Sep 2016 17:23:58 GMT thomrs 2016-09-16T17:23:58Z https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-extract-URL-information-from-logs/m-p/278124#M83946 <P>What would be the fastest way to grab the URLs out of logs in Splunk? I am thinking a regex expression would work, but how would I format that? Some of the logs are Sourcefire, some are not. Any ideas?</P> Wed, 14 Sep 2016 20:05:20 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-extract-URL-information-from-logs/m-p/278124#M83946 z782568 2016-09-14T20:05:20Z https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-extract-URL-information-from-logs/m-p/278125#M83947 <P>Something link this:</P> <P>rex field=_raw "(?https?:\/\/[\da-z.-]+.[a-z.]{2,6}[\/\w .-]*)" </P> Fri, 16 Sep 2016 17:23:58 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-extract-URL-information-from-logs/m-p/278125#M83947 thomrs 2016-09-16T17:23:58Z