Splunk Search

Remove everything after .com in website

N5535
Loves-to-Learn Everything

Is there a simple way to remove everything after website.com

Currently I have several urls imported into splunk, some of which has full paths following .com

Currently:Would like it to be:
firstwebsite.com/websitefirstwebsite.com
secondwebsite.comsecondwebsite.com
thirdwebsite.com/jigiiit/jjejjrejrthirdwebsite.com
fourthwebsite.com/hjehfourthwebsite.com

 

Any pointers would be great!

Labels (2)
0 Karma

mayurr98
Super Champion

try this:

 

 

| rex field=url_field "http(|s):\/\/(?<url>[^\/]+)"

 

Tags (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @N5535,

Please try below;

| rex field=url_field "^(?<cleaned_url>[^\/]+)"
| table url_field cleaned_url
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

N5535
Loves-to-Learn Everything

@scelikok ,

I should have mentioned that there is https:// in front of the url's.

My results are 

https://

https://

https://

https://

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...