Splunk Search

need rex help

vikram1583
Explorer

in my event i want to extract TLD's

i want to extract:
com
news
tech
net
org

please help me with rex?
thanks in advance

Tags (2)
0 Karma

woodcock
Esteemed Legend
0 Karma

sumanssah
Communicator

Try this

(?<TLD>\.\w+?)(?:$|\/)
0 Karma

to4kawa
Ultra Champion
rex field=your_field "(?<TLD>com|news|tech|net|org)"
0 Karma

manjunathmeti
Champion

Hi @vikram1583,

Try this:

| rex "\w*\.(?<tld>[a-z]+)$" 
0 Karma

vikram1583
Explorer

not working

0 Karma

to4kawa
Ultra Champion

not working
hec? what is "TLD" you say?

0 Karma

manjunathmeti
Champion

Please share some raw data.

0 Karma

efavreau
Motivator

@vikram1583 What do your logs look like? Are you extracting from fields that already identified websites or email addresses or do you have a mess in your logs that you need to identify the pattern first and then the TLD? Are these URL's fully qualified, like https://www.example.com/, or are the more like example.com? Do they end at the TLD, or continue with parameters/directories/etc.? Details and a log sample will go a long way in people being able to help you efficiently.

###

If this reply helps you, an upvote would be appreciated.
0 Karma

efavreau
Motivator

@vikram1583 I maintain that this will go better with more details and a log sample. Please edit your question with a sample log (scrub for anything sensitive). Some of these proposed solutions aren't successful against patterns such as:
https://answers.splunk.com/answers/806969/need-rex-help.html (where the valid TLD is com)
www.example.wanggou (where the valid TLD would be wanggou)
etc.

###

If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...