{"id":73143,"date":"2023-05-03T12:22:54","date_gmt":"2023-05-03T12:22:54","guid":{"rendered":"https:\/\/merikebi.warrenmyers.com\/?p=73143"},"modified":"2023-05-03T12:22:54","modified_gmt":"2023-05-03T12:22:54","slug":"answer-by-warren-for-regex-breaks-with-character-instead-of-newline","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=73143","title":{"rendered":"Answer by warren for Regex breaks with &#8220;\/&#8221; character instead of newline"},"content":{"rendered":"<p>Instead of using <a href=\"https:\/\/docs.splunk.com\/Documentation\/Splunk\/latest\/SearchReference\/rex\" rel=\"nofollow noreferrer\"><code>rex<\/code><\/a>, this can all be done with <a href=\"https:\/\/docs.splunk.com\/Documentation\/Splunk\/latest\/SearchReference\/eval\" rel=\"nofollow noreferrer\"><code>eval<\/code><\/a> and <a href=\"https:\/\/docs.splunk.com\/Documentation\/Splunk\/latest\/SearchReference\/mvexpand\" rel=\"nofollow noreferrer\"><code>mvexpand<\/code><\/a><\/p>\n<p>A run-anywhere example:<\/p>\n<pre><code>| makeresults\n| eval urls=&quot;https:\/\/www.example.org\/|http:\/\/example.com\/|ca.gov|http:\/\/blade.example.com\/bikes\/airplane.php|http:\/\/alarm.example.com\/|smugmug.com|shop-pro.jp|https:\/\/example.org\/|qq.com|pcworld.com|symantec.com|360.cn|http:\/\/example.com\/?brother=bike|http:\/\/www.example.com\/behavior\/bead.php|army.mil|https:\/\/example.com\/boy\/bedroom.php|https:\/\/example.com\/|https:\/\/www.example.com\/brother?activity=believe|https:\/\/www.example.net\/achiever\/bottle.html|http:\/\/believe.example.com\/bit?bait=base&amp;bone=ball|aboutads.info|http:\/\/www.example.com\/|http:\/\/www.example.edu\/afternoon|livejournal.com|http:\/\/border.example.com\/box\/afterthought|oaic.gov.au|https:\/\/www.example.edu\/base.php|house.gov|smh.com.au|http:\/\/www.example.edu\/|https:\/\/www.example.org\/|lycos.com|https:\/\/border.example.com\/?bridge=basket&amp;blood=animal|hibu.com|http:\/\/example.com\/&quot;\n| eval urls=split(urls,&quot;|&quot;)\n| mvexpand urls\n| eval busted=split(urls,&quot;:&quot;)\n| eval busted=mvindex(trim(split(trim(replace(mvfilter(match(busted,&quot;\\.&quot;)),&quot;\\\/&quot;,&quot; &quot;)),&quot; &quot;)),0)\n<\/code><\/pre>\n<p>I combined the last several steps into one line, but this is what it&#8217;s doing:<\/p>\n<ul>\n<li>break the URL list based on the pipe (&quot;<code>|<\/code>&quot;) character<\/li>\n<li><code>mvexpand<\/code> the multivalue field<\/li>\n<li><code>split<\/code> each individual URL on the <code>:<\/code> character (if it&#8217;s not there, there&#8217;s nothing to <code>split<\/code><\/li>\n<li>select the 0th (first) element of the following <code>match<\/code>ed <code>split<\/code> in an <code>mvfilter<\/code>:\n<ul>\n<li>everything that has a period (&quot;<code>.<\/code>&quot;) that<\/li>\n<li>has slashes (&quot;<code>\/<\/code>&quot;) replace with a space (&quot;<code> <\/code>&quot;) and<\/li>\n<li>is split on the space (&quot;<code> <\/code>&quot;)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>Your desired fqdn is now in <code>busted<\/code><\/p>\n<p>Extracting the TLD is now trivial. Append the following:<\/p>\n<pre><code>| rex field=busted &quot;(?&lt;tld&gt;[0-9a-zA-Z][0-9a-zA-Z_\\-]+?\\.[0-9a-zA-Z]+)$&quot;\n<\/code><\/pre>\n<p>Or, to keep with just an <code>eval<\/code>, skipping <code>rex<\/code> entirely, do this:<\/p>\n<pre><code>| eval tld=mvindex(split(busted,&quot;.&quot;),-2) +&quot;.&quot;+ mvindex(split(busted,&quot;.&quot;),-1)\n<\/code><\/pre>\n<p>from User warren &#8211; Stack Overflow https:\/\/stackoverflow.com\/questions\/76162456\/regex-breaks-with-character-instead-of-newline\/76163721#76163721<br \/>\nvia <a href=\"https:\/\/ifttt.com\/?ref=da&#038;site=wordpress\">IFTTT<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Instead of using rex, this can all be done with eval and mvexpand A run-anywhere example: | makeresults | eval urls=&quot;https:\/\/www.example.org\/|http:\/\/example.com\/|ca.gov|http:\/\/blade.example.com\/bikes\/airplane.php|http:\/\/alarm.example.com\/|smugmug.com|shop-pro.jp|https:\/\/example.org\/|qq.com|pcworld.com|symantec.com|360.cn|http:\/\/example.com\/?brother=bike|http:\/\/www.example.com\/behavior\/bead.php|army.mil|https:\/\/example.com\/boy\/bedroom.php|https:\/\/example.com\/|https:\/\/www.example.com\/brother?activity=believe|https:\/\/www.example.net\/achiever\/bottle.html|http:\/\/believe.example.com\/bit?bait=base&amp;bone=ball|aboutads.info|http:\/\/www.example.com\/|http:\/\/www.example.edu\/afternoon|livejournal.com|http:\/\/border.example.com\/box\/afterthought|oaic.gov.au|https:\/\/www.example.edu\/base.php|house.gov|smh.com.au|http:\/\/www.example.edu\/|https:\/\/www.example.org\/|lycos.com|https:\/\/border.example.com\/?bridge=basket&amp;blood=animal|hibu.com|http:\/\/example.com\/&quot; | eval urls=split(urls,&quot;|&quot;) | mvexpand urls | eval busted=split(urls,&quot;:&quot;) | eval busted=mvindex(trim(split(trim(replace(mvfilter(match(busted,&quot;\\.&quot;)),&quot;\\\/&quot;,&quot; &quot;)),&quot; &quot;)),0) I combined the last several steps into one line, but this is what it&#8217;s doing: break the URL list based &hellip;<br \/><a href=\"https:\/\/merikebi.warrenmyers.com\/?p=73143\" class=\"more-link pen_button pen_element_default pen_icon_arrow_double\">Continue reading <span class=\"screen-reader-text\">Answer by warren for Regex breaks with &#8220;\/&#8221; character instead of newline<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4],"tags":[991],"keyring_services":[],"class_list":["post-73143","post","type-post","status-publish","format-standard","hentry","category-blih","tag-stackexchange"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/73143","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=73143"}],"version-history":[{"count":1,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/73143\/revisions"}],"predecessor-version":[{"id":73144,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/73143\/revisions\/73144"}],"wp:attachment":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=73143"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=73143"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=73143"},{"taxonomy":"keyring_services","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fkeyring_services&post=73143"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}