Splunk Search

TLD Extraction for Report

TucoRameriz
Explorer

I'm looking at creating a report that extracts suspicious TLDS over a period of time such as, as past six hours, or past twelve hours etc. Some of the TLD that I want to look at would be .ru, .ua or double like .rr.nu or cz.cc.

I'm looking for a good way to extract the TLD from the URL and display that in a chart. I've seen a few regex's floating around but haven't had much luck modifying them into what I want to do.

Thanks in advance

Tags (2)

Dallastek
Explorer

I am trying to use a erex with several examples to do the same thing.
http://docs.splunk.com/Documentation/Splunk/4.1.5/SearchReference/Erex

0 Karma

Dallastek
Explorer

Try using this regex | rex "(?i)(?P.\w+)\d+.\w+\s+\d+\s+(?:/[^/]*){4}"

0 Karma

phudinhha
Explorer

Does anyone have the answer for this question? I'm looking for the same thing.

0 Karma

veryous
Engager

Looking for the same answer to this too.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...