Splunk Search

Split the address field with regular

WXY
Path Finder

I want to use rex to get a field value.
Now I have a field named URL
Some data such as :

http://10.2.3.44:8080
http://1.3.2.55:8011/Login.aspx
https://wwx.ff-ac.com/login
https://192.443.67.91:8044/bs_y/index.jsp
http://rr-ww.ff-ac.com/rr_platform_ww/ayyu
 https://t.ff-ac.com/ipi/IP_A/login.do?p=I_log 

But I just want to get such as

http://10.2.3.44:8080
 http://1.3.2.55:8011
 https://wwx.ff-ac.com
 https://192.443.8.91:8044
 http://rr-ww.ff-ac.com
 https://t.ff-ac.com

The above data is written randomly according to my data.

That is to say I only hope to get [http|https]://IP:port OR [http|https]://domain

What should I do?

Tags (3)
0 Karma

gokadroid
Motivator

Lets say your url data is in field called URL then you can try below to get the required data in a field called myRequiredData:

your query to return URL field
| rex field=URL "(?<myRequiredData>(http(s)*:\/\/)[^\/\s]+)"
| table URL, myRequiredData

See the regex reference here

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...