Hi There, Thank you for stop by and helping. I've a regex which extracts all URLs and domains from given field, this regex is working fine with the following search query | makeresults |eval body="An issue on an object you are monitoring-- details here: https://SOME1-ORIONWB01:443/Orion/View.aspx?NetObje?a=b&c=dct=I:54020.<br/>View full alert details here: https://SOME2-ORIONWB01:443/Orion/View.aspx?NetObject=AAT:90460" |rex max_match=0 field=body "(?<URL>(?<proto>(((https?|ftp|gopher|telnet|file)(:\/\/))|(www\.)))(?<domain>[:\w\.-]+)[\w\&\=\/\?\.\:]+)" but, when I put the same regex in props.conf (Settings>> Fields » Field extractions » domain_extractor, it is extracting only first URL and domain. I see the manual search "has max_match=0", I could not find similar config for "Filed extractions", Any suggestions? if there is any such config OR do we need to do this in different way? TIA.
... View more