Splunk Search

need rex help

vikram1583
Explorer

in my event i want to extract TLD's

i want to extract:
com
news
tech
net
org

please help me with rex?
thanks in advance

Tags (2)
0 Karma

woodcock
Esteemed Legend
0 Karma

sumanssah
Communicator

Try this

(?<TLD>\.\w+?)(?:$|\/)
0 Karma

to4kawa
Ultra Champion
rex field=your_field "(?<TLD>com|news|tech|net|org)"
0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Hi @vikram1583,

Try this:

| rex "\w*\.(?<tld>[a-z]+)$" 
0 Karma

vikram1583
Explorer

not working

0 Karma

to4kawa
Ultra Champion

not working
hec? what is "TLD" you say?

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Please share some raw data.

0 Karma

efavreau
Motivator

@vikram1583 What do your logs look like? Are you extracting from fields that already identified websites or email addresses or do you have a mess in your logs that you need to identify the pattern first and then the TLD? Are these URL's fully qualified, like https://www.example.com/, or are the more like example.com? Do they end at the TLD, or continue with parameters/directories/etc.? Details and a log sample will go a long way in people being able to help you efficiently.

###

If this reply helps you, an upvote would be appreciated.
0 Karma

efavreau
Motivator

@vikram1583 I maintain that this will go better with more details and a log sample. Please edit your question with a sample log (scrub for anything sensitive). Some of these proposed solutions aren't successful against patterns such as:
https://answers.splunk.com/answers/806969/need-rex-help.html (where the valid TLD is com)
www.example.wanggou (where the valid TLD would be wanggou)
etc.

###

If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...