I have CSV inputs that include a URL field. I would like to extract the top level domain from that URL, and perform a passive reverse DNS lookup to obtain the IP address. Can this be accomplished from the conf files at search time?
Go to menu Settings -> Fields -> Fields Extraction, click New and create your field extraction there. You should associate it to the sourcetype or source. Give it a name and use the same Regex there. Don't forget to set the permissions right, normally I use Scope: "App" and "Read" to everyone.
