Splunk Search
Highlighted

How to write a regular expression to extract the domain name from dest_host field?

Builder

Hi,

How to write a regular expression to use to extract the domain name from the dest_host, like extracting the last character before second "."
for example:
stg-ec-ore-u.uplynk.com
7.tlu.dl.delivery.mp.microsoft.com

stg-ec-norcal-u.microsoft.com

foxnews-f.akamaihd.net

cnnios-f.akamaihd.net

daarack02.vpg.cdn.yimg.com

redir.adap.tv

Required Output:
.uplynk.com
.microsoft.com

.akamaihd.net

.yimg.com
.adap.tv

0 Karma
Highlighted

Re: How to write a regular expression to extract the domain name from dest_host field?

SplunkTrust
SplunkTrust

Try like this

Updated

your search | rex field=dest_host "(?<domain>\.[A-z0-9]+\.[A-z0-9]+)$"

View solution in original post

0 Karma
Highlighted

Re: How to write a regular expression to extract the domain name from dest_host field?

Builder

I tried, its not working

0 Karma
Highlighted

Re: How to write a regular expression to extract the domain name from dest_host field?

SplunkTrust
SplunkTrust

Missed a + sign at the end. Try the updated answer.

0 Karma
Highlighted

Re: How to write a regular expression to extract the domain name from dest_host field?

Builder

Thanks somesoni2! It worked, is there a way to remove . before domain name.

0 Karma
Highlighted

Re: How to write a regular expression to extract the domain name from dest_host field?

SplunkTrust
SplunkTrust

Just remove the \. after <domain>. A more accurate version would be like this

your search | rex field=dest_host "\.(?<domain>[A-z0-9]+\.[A-z0-9]+)$"
0 Karma
Highlighted

Re: How to write a regular expression to extract the domain name from dest_host field?

Builder

try this:

rex field=dest_host "[^\.]+(?<domain>.+)"
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.