extract_url_host ↗

Use the extract_url_host() function to return the host portion of a given URL string.

Syntax

extract_url_host (<url_string>)

Parameters

Name Type Required Description
url_string string Yes The input string literal or field containing the URL from which the host needs to be extracted.

Returns

The extract_url_host() function returns a string representing the host of the URL.

Usage notes

  • The function always returns the host value in lowercase characters, regardless of the input URL's original casing.
  • This function is typically used within the alter stage to create new fields or modify existing ones based on extracted URL data, or within the filter stage for conditional logic.
  • If the input url_string is NULL, the function returns NULL.

Examples

Example 1: Basic host extraction from a standard URL

Goal: Extract the host from a common HTTPS URL.

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw 
| alter extracted_host = extract_url_host("https://www.paloaltonetworks.com") 
| fields event_id, extracted_host 
| limit 1

Explanation: The query extracts the host "www.paloaltonetworks.com" from the provided URL string.

Output:

EVENT_ID EXTRACTED_HOST
101 www.paloaltonetworks.com

Example 2: Host extraction from a URL with user, password, and port

Goal: Extract the host from a complex URL that includes user credentials and port numbers.

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw 
| alter extracted_host_complex = extract_url_host("//user:password@a.b:80/path?query") 
| fields event_id, extracted_host_complex 
| limit 1

Explanation: extract_url_host() successfully isolates "a.b" as the host, ignoring the user, password, port, path, and query parameters.

Output:

EVENT_ID EXTRACTED_HOST_COMPLEX
101 a.b

Example 3: Host extraction with mixed-case input

Goal: Extract the host from a URL containing uppercase letters, demonstrating the automatic lowercasing behavior.

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw 
| alter extracted_host_lowercase = extract_url_host("www.Example.Co.UK") 
| fields event_id, extracted_host_lowercase 
| limit 1

Explanation: Despite "www.Example.Co.UK" having mixed casing, the function returns "www.example.co.uk" in all lowercase, demonstrating its built-in lowercasing behavior.

Output:

EVENT_ID EXTRACTED_HOST_LOWERCASE
101 <www.example.co.uk>

Example 4: Host extraction from a URL with multiple suffixes/paths

Goal: Extract the full hostname from a URL that includes subdomains and extended paths.

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw 
| alter extracted_host_path = extract_url_host("https://www.test.paloaltonetworks.com/suffix/another_suffix") 
| fields event_id, extracted_host_path 
| limit 1

Explanation: The function correctly identifies the entire host, including subdomains, regardless of the trailing path components.

Output:

EVENT_ID EXTRACTED_HOST_PATH
101 www.test.paloaltonetworks.com

Example 5: Handling NULL input

Goal: Demonstrate the function's behavior when provided with a NULL input.

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw 
| alter null_url_input = NULL 
| alter extracted_host_from_null = extract_url_host(null_url_input) 
| fields event_id, null_url_input, extracted_host_from_null 
| limit 1

Explanation: Consistent with standard XQL function behavior, if the input to extract_url_host() is NULL, the function returns NULL.

Output:

EVENT_ID NULL_URL_INPUT EXTRACTED_HOST_FROM_NULL
101 NULL NULL

Example: Host extraction from a URL string

Goal: Return a single record from the sample_xql_raw dataset showing the extracted host name from a specific URL string ("https://www.test.paloaltonetworks.com").

XQL Code:

config timeframe = 1d 
| dataset = sample_xql_raw 
| alter url_host = extract_url_host("https://www.test.paloaltonetworks.com") 
| fields url_host 
| limit 1

Explanation:

  1. The query starts by accessing the xdr_data dataset.
  2. The alter stage creates a new field named url_host.
  3. The extract_url_host() function parses the provided URL string and isolates the host component (www.test.paloaltonetworks.com).
  4. The fields stage restricts the final output to only show the newly created url_host column.
  5. The limit 1 stage ensures that only a single result is returned.

Output:

url_host
"www.test.paloaltonetworks.com"