Can you help me come up with the regex to get the domain + scheme?

[jtotzek]

Hi,

I tried many things but I still cannot get to the correct result.

my field value looks like this
http://34.223.245.254/path/user.html
http://sub.domain.com/D2-Client
https://sub.domain.ph

and in the output I just want
http://34.223.245.254
http://sub.domain.com
https://sub.domain.ph

so far it looks like this:

BASE-SEARCH | rex field="MY_FIELD_NAME" "(REGEX)" | stats values("domain")

[ddrillic]

You can try -

BASE-SEARCH | erex _raw url "http://34.223.245.254,http://sub.domain.com,https://sub.domain.ph"

Under Job you should see the generated regex...

[renjith_nair · Accepted solution]

@jtotzek,

Give this a try and see if it works,

|rex field=YOUR_FIELD_NAME "(?<domain>https?:\/\/[^\/]+)"

[jtotzek]

wow, perfect! I was almost there! thanks a lot!

[renjith_nair]

@jtotzek, glad it worked for you. Please accepts answer to close the thread

[renjith_nair]

@jtotzek, do you have any other question on this ? If not, kindly accept as answer .