Splunk Search

need rex help

vikram1583
Explorer

in my event i want to extract TLD's

i want to extract:
com
news
tech
net
org

please help me with rex?
thanks in advance

Tags (2)
0 Karma

woodcock
Esteemed Legend
0 Karma

sumanssah
Communicator

Try this

(?<TLD>\.\w+?)(?:$|\/)
0 Karma

to4kawa
Ultra Champion
rex field=your_field "(?<TLD>com|news|tech|net|org)"
0 Karma

manjunathmeti
Champion

Hi @vikram1583,

Try this:

| rex "\w*\.(?<tld>[a-z]+)$" 
0 Karma

vikram1583
Explorer

not working

0 Karma

to4kawa
Ultra Champion

not working
hec? what is "TLD" you say?

0 Karma

manjunathmeti
Champion

Please share some raw data.

0 Karma

efavreau
Motivator

@vikram1583 What do your logs look like? Are you extracting from fields that already identified websites or email addresses or do you have a mess in your logs that you need to identify the pattern first and then the TLD? Are these URL's fully qualified, like https://www.example.com/, or are the more like example.com? Do they end at the TLD, or continue with parameters/directories/etc.? Details and a log sample will go a long way in people being able to help you efficiently.

###

If this reply helps you, an upvote would be appreciated.
0 Karma

efavreau
Motivator

@vikram1583 I maintain that this will go better with more details and a log sample. Please edit your question with a sample log (scrub for anything sensitive). Some of these proposed solutions aren't successful against patterns such as:
https://answers.splunk.com/answers/806969/need-rex-help.html (where the valid TLD is com)
www.example.wanggou (where the valid TLD would be wanggou)
etc.

###

If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...