Splunk Search

Exclude path from URL in Search Results

spfingst87
Loves-to-Learn

Hi

I want to exclude the path from search results, i.e.:

www.testsite.com

www.testsite.com/path1

www.testsite.com/path2

www.testsite.com/path3

www.secondsite.com

www.secondsite.com/path1

 

From the above, all the sites are displaying in my search. I only want www.testsite.com and www.secondsite.com to show in search and rest of sites to be excluded.

Thanks.

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| regex _raw!="/"

Replace _raw with your field name if appropriate

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There probably are a few ways to do that.  I'd use rex to extract the site from the URL.

... | rex field=url "(?<site>[^\/]+)"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

spfingst87
Loves-to-Learn

Thanks for the fast response 🙂

I tried this and still the search is producing URL paths. In the site, do I need to put a variable?

As a note, there are around 50 URLs in my search and around 10 of them are displaying several paths each. So I am looking for as universal solution for any current or future URLs added to exclude the path (if that makes any sense :)) not just for 1 specific URL.

Thanks again!

0 Karma

bowesmana
SplunkTrust
SplunkTrust

The suggested solution was for a field called url and it will extract a new field called site.

Depending on your data, replace 'url' with your input field and use the new field site for your analysis

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...