i'm using URL Toolbox for analysing url entropy, shannon and meaning scoring is working also simple parse of url. I now want to extract the main url to match against some TI List but the ut_parse_extended(url, list) macro does not work. I'm using latest URl Toolbox Version 1.6 and Splunk 7.2.x.
This is my example Query:
| eval url="www.domain.com"
| lookup ut_parse_simple_lookup url as url
| lookup ut_parse_extended_lookup url as url list as mozilla
This does not include extractions from extended parse...any idea?