Splunk Search

How to trim away the port and use only URL after ":"?

kiran331
Builder

Hi,

I have a field with values URL and port, how to trim away the port and only use URL?
For example,

abc.net:9090
abc.bb23.org:8081

required output:

abc.net
abc.bb23.org
Tags (2)

mayurr98
Super Champion

hey try this run anywhere search

| makeresults 
| eval data="abc.net:9090 abc.bb23.org:8081" 
| makemv data 
| mvexpand data 
| rex field=data "^(?P<URL>[^\:]+)\:"

In your environment, you should write

<your_base_search> | rex field=<field_name>  "^(?P<URL>[^\:]+)\:"

let me know if this helps!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

One way is with rex.

... | rex field=foo "(?<URL>[^:]+)" | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

supabuck
Path Finder

Hello,

You want to use a regular expression to complete this.

If your field is called ipaddr the following code would apply. Replace the word ipaddr with whatever field you have which captures the IP address.

index=foo sourcetype=bar | rex field=ipaddr "(?P<ipaddr>.*):"

This returns everything before the : and places it in the field called ipaddr.

Let me know if this works.

Thank you,
Supabuck

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...