Splunk Search

Exclude path from URL in Search Results

spfingst87
Loves-to-Learn

Hi

I want to exclude the path from search results, i.e.:

www.testsite.com

www.testsite.com/path1

www.testsite.com/path2

www.testsite.com/path3

www.secondsite.com

www.secondsite.com/path1

 

From the above, all the sites are displaying in my search. I only want www.testsite.com and www.secondsite.com to show in search and rest of sites to be excluded.

Thanks.

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| regex _raw!="/"

Replace _raw with your field name if appropriate

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There probably are a few ways to do that.  I'd use rex to extract the site from the URL.

... | rex field=url "(?<site>[^\/]+)"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

spfingst87
Loves-to-Learn

Thanks for the fast response 🙂

I tried this and still the search is producing URL paths. In the site, do I need to put a variable?

As a note, there are around 50 URLs in my search and around 10 of them are displaying several paths each. So I am looking for as universal solution for any current or future URLs added to exclude the path (if that makes any sense :)) not just for 1 specific URL.

Thanks again!

0 Karma

bowesmana
SplunkTrust
SplunkTrust

The suggested solution was for a field called url and it will extract a new field called site.

Depending on your data, replace 'url' with your input field and use the new field site for your analysis

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...