Splunk Search

Exclude path from URL in Search Results

spfingst87
Loves-to-Learn

Hi

I want to exclude the path from search results, i.e.:

www.testsite.com

www.testsite.com/path1

www.testsite.com/path2

www.testsite.com/path3

www.secondsite.com

www.secondsite.com/path1

 

From the above, all the sites are displaying in my search. I only want www.testsite.com and www.secondsite.com to show in search and rest of sites to be excluded.

Thanks.

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| regex _raw!="/"

Replace _raw with your field name if appropriate

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There probably are a few ways to do that.  I'd use rex to extract the site from the URL.

... | rex field=url "(?<site>[^\/]+)"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

spfingst87
Loves-to-Learn

Thanks for the fast response 🙂

I tried this and still the search is producing URL paths. In the site, do I need to put a variable?

As a note, there are around 50 URLs in my search and around 10 of them are displaying several paths each. So I am looking for as universal solution for any current or future URLs added to exclude the path (if that makes any sense :)) not just for 1 specific URL.

Thanks again!

0 Karma

bowesmana
SplunkTrust
SplunkTrust

The suggested solution was for a field called url and it will extract a new field called site.

Depending on your data, replace 'url' with your input field and use the new field site for your analysis

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...