TLD Extraction for Report

[TucoRameriz]

I'm looking at creating a report that extracts suspicious TLDS over a period of time such as, as past six hours, or past twelve hours etc. Some of the TLD that I want to look at would be .ru, .ua or double like .rr.nu or cz.cc.

I'm looking for a good way to extract the TLD from the URL and display that in a chart. I've seen a few regex's floating around but haven't had much luck modifying them into what I want to do.

Thanks in advance

[Dallastek]

I am trying to use a erex with several examples to do the same thing.
http://docs.splunk.com/Documentation/Splunk/4.1.5/SearchReference/Erex

[Dallastek]

Try using this regex | rex "(?i)(?P.\w+)\d+.\w+\s+\d+\s+(?:/[^/]*){4}"

[phudinhha]

Does anyone have the answer for this question? I'm looking for the same thing.

[veryous]

Looking for the same answer to this too.