extract_url_pub_suffix ↗

Use the extract_url_pub_suffix() function to return the public suffix of a given URL string (for example, "com", "org", "net").

Syntax

extract_url_pub_suffix ("<URL>")

Parameters

Name Type Required Description
<URL> string Yes The input string literal or field containing the URL from which the public suffix needs to be extracted.

Returns

The extract_url_pub_suffix() function returns a string representing the public suffix of the URL.

Usage notes

  • The function requires a string value representing a URL as input.
  • The function always returns the public suffix value in lowercase characters, regardless of the input URL's original casing.
  • This function is typically used within the alter stage to create new fields or modify existing ones based on extracted URL data, or within the filter stage for conditional logic.

Examples

Example 1: Basic public suffix extraction from a standard URL

Goal: Extract the public suffix from a common HTTPS URL.

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw 
| alter extracted_pub_suffix = extract_url_pub_suffix("https://www.paloaltonetworks.com") 
| fields event_id, extracted_pub_suffix 
| limit 1

Explanation: The query extracts "com" as the public suffix from the URL "https://www.paloaltonetworks.com".

Output:

EVENT_ID EXTRACTED_PUB_SUFFIX
101 "com"

Example 2: Public suffix extraction from a URL with multiple suffixes/paths

Goal: correctly identify only the public suffix from a URL that includes subdomains and extended paths.

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw 
| alter extracted_pub_suffix_complex = extract_url_pub_suffix("https://www.test.paloaltonetworks.com/suffix/another_suffix") 
| fields event_id, extracted_pub_suffix_complex 
| limit 1

Explanation: The function correctly isolates "com" as the public suffix, ignoring subdomains and path components.

Output:

EVENT_ID EXTRACTED_PUB_SUFFIX_COMPLEX
101 "com"

Example 3: Public suffix extraction with mixed-case input

Goal: Demonstrate that the function returns the public suffix in lowercase characters, even if the input URL contains uppercase letters.

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw 
| alter extracted_pub_suffix_lowercase = extract_url_pub_suffix("www.Example.Co.UK") 
| fields event_id, extracted_pub_suffix_lowercase 
| limit 1

Explanation: Despite "www.Example.Co.UK" having mixed casing, the function returns "uk" in all lowercase, demonstrating its built-in lowercasing behavior.

Output:

EVENT_ID EXTRACTED_PUB_SUFFIX_LOWERCASE
101 "uk"

Example 4: Handling NULL input

Goal: Demonstrate the function's behavior when provided with a NULL input.

XQL code:

config timeframe = 1d 
| dataset = sample_xql_raw 
| alter null_url_input = NULL 
| alter extracted_pub_suffix_from_null = extract_url_pub_suffix(null_url_input) 
| fields event_id, null_url_input, extracted_pub_suffix_from_null 
| limit 1

Explanation: Consistent with standard XQL function behavior, if the input to extract_url_pub_suffix() is NULL, the function returns NULL.

Output:

EVENT_ID NULL_URL_INPUT EXTRACTED_PUB_SUFFIX_FROM_NULL
101 NULL NULL