Hi,
All my URLs have this general format https://value.company.com.au/etc/ Is there a way I can extract URLs and always stop at the .au but also have this included in the field? Some differ with a port at the end so its goes https://value.company.com.au:9001 but I don't want the port or anything after the /.
Do you have any recommendations on what the regex would look like?
(?<url>https?:\/\/[^:\/]+)
Hello,
Thanks for that, but it not works on my Splunk research, I get the following message :
Error in 'SearchParser': Missing a search command before '^'. Error at position '86' of search query 'search index=* sourcetype="os_win_wks:java:trace" ...{snipped} {errorcontext = tps?:\/\\[^:\/]+)}'.
Do you know why ?
Thanks
Because you are not using it to extract the field correctly. Rather than trying to extend someone else's question, please ask a fresh question where you can define your usecase more fully.
Thanks so much!