Splunk Search

How to extract only the top level domain (TLD) from email addresses?

ICAJschuster
Engager

I am working with an email application. Currently doing a report based on domains using the product. Issue is there are many, and often arbitrary sub-domains. This is what I'm currently using:

rex field=Sender ".[^@]+?@(?<sender_domain>.+)"

The results from that look like:
test.com
sub.test.com
why.so.many.subs.echo.com
a.echo.com

So what is the "right" way to get the last 2 fields on either side of the last DOT in the field?
This is close but it only matches IF there is a subdomain and many are just TLD:

   rex field=Sender ".[^@]+?@.*(?<sender_domain>\.\w+\.[a-zA-Z]+$)"

Thanks!

1 Solution

cpetterborg
SplunkTrust
SplunkTrust

Try:

rex field=Sender "(?P<sender_domain>[A-Za-z0-9]+\.[a-zA-Z]+)$"

All you need is to look at the last part, not the whole email to get what you need, and this will find it easily.

View solution in original post

cpetterborg
SplunkTrust
SplunkTrust

Try:

rex field=Sender "(?P<sender_domain>[A-Za-z0-9]+\.[a-zA-Z]+)$"

All you need is to look at the last part, not the whole email to get what you need, and this will find it easily.

acharlieh
Influencer

This is indeed what was asked for, however, depending on what you're doing with this, you may want to look a bit deeper:

1) "Top Level domains" for some country codes you may actually want the 3rd level. For example: "amazon.co.uk"
2) You need to include hyphens and other characters as well, otherwise you may miss some domains. Of note internationalized domain names are actually prefixed: xn--

ICAJschuster
Engager

Perfect! Thank you so much!

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...