Is there a simple way to remove everything after website.com
Currently I have several urls imported into splunk, some of which has full paths following .com
| Currently: | Would like it to be: | 
| firstwebsite.com/website | firstwebsite.com | 
| secondwebsite.com | secondwebsite.com | 
| thirdwebsite.com/jigiiit/jjejjrejr | thirdwebsite.com | 
| fourthwebsite.com/hjeh | fourthwebsite.com | 
Any pointers would be great!
 
					
				
		
 
		
		
		
		
		
	
			
		
		
			
					
		Hi @N5535,
Please try below;
| rex field=url_field "^(?<cleaned_url>[^\/]+)"
| table url_field cleaned_urlI should have mentioned that there is https:// in front of the url's.
My results are
https://
https://
https://
https://
