Splunk Search

Extracting domain name from URL

pjtbasu
Explorer

Hi,

 

I've a field with name URL and values are like this -- 

https://community.splunk.com/t5/forums/postpage/21321231312331112/id
http://www.google.com/search?rlz=1C1GCEA_enU

I need to extract it like this (it can be http or https and it can be other tld too)- 

https://community.splunk.com
http://www.google.com

 

So basically need a rex like this - parta://partb/Ignorable_strings and then I'll concatenate parta and partb fields to get desired result. Someone please help.

Labels (2)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

| rex field=url "^(?<main_domain>\w+\:\/\/[^\/]+)"

output will be extracted to new field called main_domain

if you need parta and partb and igorable_strings use below:

| rex field=url "^(?<parta>\w+)\:\/\/(?<partb>[^\/]+)\/(?<ignorable_strings>.*)"

————————————
If this helps, give a like below.

View solution in original post

pjtbasu
Explorer

Thank you!

Possible for you to explain the parts of first regex like how it is working ? Are you aware of any specific documentation which will help me understand/learn complex splunk regex ?

0 Karma

thambisetty
SplunkTrust
SplunkTrust

https://www.youtube.com/watch?v=LoiyiCVGLnw

————————————
If this helps, give a like below.
0 Karma

thambisetty
SplunkTrust
SplunkTrust

| rex field=url "^(?<main_domain>\w+\:\/\/[^\/]+)"

output will be extracted to new field called main_domain

if you need parta and partb and igorable_strings use below:

| rex field=url "^(?<parta>\w+)\:\/\/(?<partb>[^\/]+)\/(?<ignorable_strings>.*)"

————————————
If this helps, give a like below.
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...