Splunk Search

How to automatically extract domain from URL through conf files at search-time?

david_rundle_fi
Explorer

I have CSV inputs that include a URL field. I would like to extract the top level domain from that URL, and perform a passive reverse DNS lookup to obtain the IP address. Can this be accomplished from the conf files at search time?

Tags (5)

musskopf
Builder

Go to menu Settings -> Fields -> Fields Extraction, click New and create your field extraction there. You should associate it to the sourcetype or source. Give it a name and use the same Regex there. Don't forget to set the permissions right, normally I use Scope: "App" and "Read" to everyone.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This will get you the domain. I can't help with the DNS lookup.

... | rex field=URL "https?:\/\/(?<domain>[^/]+)" | ...
---
If this reply helps you, Karma would be appreciated.

david_rundle_fi
Explorer

I have a regex for extraction, but I would like to automate the process.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...