Excluding a specific URL in Regex

[SplunkNewbie18]

Hi,

I read through forums on how to extract URLs using regex. But couldn't find those on how to exclude them.

For example, how do I extract all domain except for "google.com.sg".

Thanks!

[horsefez · Accepted solution]

Hey,

so you particularely asked about removing it via the use of regular expression.
Let me give you an example:

google.com
google.com.sg
facebook.com
splunk.com
answers.splunk.com
idontknowanyurlsanymore.ru
iamahorseandilikeit.horse.me
factor.io

I've built a regular expression using a negative lookahead (?!...) to exclude the url from matching.
^(?!google\.com\.sg)(?<url>[^\n]+)(?:\n|)

https://regex101.com/r/wQ74EI/1

Let me know if you need additional help and/or explanation.

Cheers!

[SplunkNewbie18]

Hi!

Yes, it works and this is what I wanted. Many thanks! 🙂

[nickhills]

If I understand what you want - you will still will need to extract the 'google.com.sg' url, but you may want to exclude it from your search.

You should be able to use != so assuming the extraction is called 'url':

<your existing search> url!=google.com.sg*|<etc..>

[Sukisen1981]

it will help if you can share your query wherein you are able to extract the url.
Also, what all urls do you want to exclude? Is it just one or do you have a list ?