Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
nathan_emerson
New Contributor

Regexp_Matches, removing the { in the result?

Howdy folks,

 

I have created a custom data set to return the number of requests per parent domain (i.e. just the values before the country code) using the regexp_matches function. The results are returned within {} braces, is there a way to suppress these in the results?

 

Here is a sample of the output:

# domain visits 1 {bitdefender.net} 66113 2 {pubnub.com} 9583 3 {doubleclick.net} 9192 4 {serving-sys.com} 6127 5 {adnxs.com} 5700 6 {googlesyndication.com} 4765 7 {bing.com} 4530

 

 

Many thanks,

 

Nathan

1 Solution
hzhao_FTNT

Hi Nathan, Sorry for my typo. Please use root_domain(hostname) to get it.  For results from "select regexp_matches() as xxx", you could use unnest(xxx) or trim(xxx:text, '{}'). But root_domain should be the easiest way.

 

hz

View solution in original post

4 REPLIES 4
hzhao_FTNT
Staff
Staff

Hi Nathan,

 

Maybe you can use root_main(hostname) to get parent domain.

 

Regards,

hz

nathan_emerson

Thanks for the suggestion, I get a no function exists error however. Do you know if I need to cast the hostname as something in particular inside this function?

 

Cheers,

 

Nathan

 

hzhao_FTNT

Hi Nathan, Sorry for my typo. Please use root_domain(hostname) to get it.  For results from "select regexp_matches() as xxx", you could use unnest(xxx) or trim(xxx:text, '{}'). But root_domain should be the easiest way.

 

hz

nathan_emerson

Thanks,

 

Both of those suggestions work as intended.

Labels
Top Kudoed Authors