Splunk Search

How to trim away the port and use only URL after ":"?

kiran331
Builder

Hi,

I have a field with values URL and port, how to trim away the port and only use URL?
For example,

abc.net:9090
abc.bb23.org:8081

required output:

abc.net
abc.bb23.org
Tags (2)

mayurr98
Super Champion

hey try this run anywhere search

| makeresults 
| eval data="abc.net:9090 abc.bb23.org:8081" 
| makemv data 
| mvexpand data 
| rex field=data "^(?P<URL>[^\:]+)\:"

In your environment, you should write

<your_base_search> | rex field=<field_name>  "^(?P<URL>[^\:]+)\:"

let me know if this helps!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

One way is with rex.

... | rex field=foo "(?<URL>[^:]+)" | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

supabuck
Path Finder

Hello,

You want to use a regular expression to complete this.

If your field is called ipaddr the following code would apply. Replace the word ipaddr with whatever field you have which captures the IP address.

index=foo sourcetype=bar | rex field=ipaddr "(?P<ipaddr>.*):"

This returns everything before the : and places it in the field called ipaddr.

Let me know if this works.

Thank you,
Supabuck

Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...