Splunk Search

Regex in Playbook

chandraprathi
Explorer

I have required where the CEF comes as URL and I need just a part of the URL to pass as input(ARTIFACT.CEF.URL) to action in Splunk phantom. I am using the phantom version 4.8. Can someone suggest me an idea on How I can just pass the part of the URL instead of the complete URL?

Labels (3)
Tags (2)
0 Karma
1 Solution

chandraprathi
Explorer
0 Karma

chandraprathi
Explorer

Thank you for your reply @sam_splunk. I have fixed it by extracting the portion of the URL which I need and forgot to mention it here.

0 Karma

sam_splunk
Splunk Employee
Splunk Employee

Did you end up doing the extraction on the Splunk side?

0 Karma

chandraprathi
Explorer

yes @sam_splunk 

0 Karma

sam_splunk
Splunk Employee
Splunk Employee

So you've got an artifact (e.g. souceAddress = "https://www.somedomain.com") and you want to trim out a portion of it (e.g. somedomain.com) to make available for downstream blocks?

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...