A parks watering-hole URL is already in the CIM url field. The analyst needs the second-level domain. How should they run rex?
Select an answer to reveal the explanation.
Short Explanation
rex is not married to _raw. Point it at url and it will carve the domain out of a field already in hand. That is cleaner than stuffing the URL back into the raw log.
Full Explanation
rex accepts a field= argument so the regex runs against an existing field such as CIM url rather than _raw. Extracting a second-level domain from a parks watering-hole URL is that pattern. Analysts should not assume rex is _raw-only. tstats and len() do not perform that extraction.