How to write rex to get "domain.com"?

[f_666dhn]

I have field user-agent like this

user-agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36\r\nHost: domain.com\r\nConnection: Keep-Alive\r\n"
 
How's the SPL query, if I just wanna get the "domain.com".

Thanks.

[gcusello]

Hi @f_666dhn,

to extract the domain from the field "user-agent", you could use a regex like this:

| rex field=user-agent "Host:\s+(?<domain>[^\\]+)"

that you can test at https://regex101.com/r/Qtk4iq/1

Ciao.

Giuseppe