I have a field "blockedUri" which can contain two types of value (string or URL). Below is an example :
blockedUri = eval
blockedUri = https://analytics.google.com/sample.js
I need a splunk search query that will trim and return the only hostname of the value if it's a URL or if it is a normal string simply return the string.
The result should be as below :
Thanks in advance
| rex field=blockURL "http(s):\/\/(?<hostname>[^\/]+)"
| eval result=coalesce(hostname,blockedURL)