| rex field=_raw "(?<url>http://[^\s]+)"
Don't forget the possibility of https:
| rex field=_raw "(?<url>https?://[^\s]+)" June 16, 2020 at 02:52PM
via reddit https://www.reddit.com/r/Splunk/comments/h9l62e/can_anyone_provide_me_with_a_regular_expression/fv1ia6w?utm_source=ifttt