thanks for the reminder. i doubt if regex (in Splunk) can do if-then-else. otherwise, a single regex cannot handle URL with many levels of sub-domains or variations. ... View more

thanks to kristian. the question is solved. the regex i used is rex field=Url "[http|https|ftp|tcp]?\:\/\/[^\.]+\.(? [^\.]+).[^\.]+\/" the regex is aimed to resolve the format ://xxx.domain.xxx/ (i duno if there is any error) ... View more

While i am still handling the regex stuff, there is actually a second question. For example, there are 2 lines of event maps.google.com bytes_a duration_a docs.google.com bytes_b duration_b Will it be combined as follows? google bytes_a+b duration_a+b ... View more

In case anyone would like to get quick answer on regex URL http://gskinner.com/RegExr/ (I suppose you need some basis on regex) ... View more

Btw, I have use the IFX and it seems not good in making custom regex for URL (I am not good at regex too). ... View more

Thank you very much. That is exactly what I would like to archieve. ... View more

I am not sure if the term "grouping" is appropriate. ... View more

I have the log downloaded from bluecoat server and would like to import it to Splunk for log analysis. Normally, splunk will treat each line (of bluecoat log) as an event. Each event contains some fields. One of them is URL-related. I would like to group each event with similar URL characteristic (i.e. under the same domain, in the example above, google). It is because the log may be huge. Doing such grouping will reduce the size. In addition, the result (or the report) looks simpler. ... View more