> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/extract_url_host.md).

# extract\_url\_host

Use the `extract_url_host()` function to return the host portion of a given URL string.

## Syntax

```sql
extract_url_host (<url_string>)
```

## Parameters

| Name         | Type   | Required | Description                                                                                     |
| ------------ | ------ | -------- | ----------------------------------------------------------------------------------------------- |
| `url_string` | string | Yes      | The input string literal or field containing the URL from which the host needs to be extracted. |

## Returns

The `extract_url_host()` function returns a string representing the host of the URL.

## Usage notes

* The function always returns the host value in lowercase characters, regardless of the input URL's original casing.
* This function is typically used within the `alter` stage to create new fields or modify existing ones based on extracted URL data, or within the `filter` stage for conditional logic.
* If the input `url_string` is NULL, the function returns NULL.

## Examples

### Example 1: Basic host extraction from a standard URL

**Goal**: Extract the host from a common HTTPS URL.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter extracted_host = extract_url_host("https://www.paloaltonetworks.com") 
| fields event_id, extracted_host 
| limit 1 
```

**Explanation**: The query extracts the host "[www.paloaltonetworks.com](http://www.paloaltonetworks.com)" from the provided URL string.

**Output**:

| EVENT\_ID | EXTRACTED\_HOST                                             |
| --------- | ----------------------------------------------------------- |
| 101       | [www.paloaltonetworks.com](http://www.paloaltonetworks.com) |

### Example 2: Host extraction from a URL with user, password, and port

**Goal**: Extract the host from a complex URL that includes user credentials and port numbers.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter extracted_host_complex = extract_url_host("//user:password@a.b:80/path?query") 
| fields event_id, extracted_host_complex 
| limit 1 
```

**Explanation**: `extract_url_host()` successfully isolates "a.b" as the host, ignoring the user, password, port, path, and query parameters.

**Output**:

| EVENT\_ID | EXTRACTED\_HOST\_COMPLEX |
| --------- | ------------------------ |
| 101       | a.b                      |

### Example 3: Host extraction with mixed-case input

**Goal**: Extract the host from a URL containing uppercase letters, demonstrating the automatic lowercasing behavior.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter extracted_host_lowercase = extract_url_host("www.Example.Co.UK") 
| fields event_id, extracted_host_lowercase 
| limit 1 
```

**Explanation**: Despite "[www.Example.Co.UK](http://www.Example.Co.UK)" having mixed casing, the function returns "[www.example.co.uk](http://www.example.co.uk)" in all lowercase, demonstrating its built-in lowercasing behavior.

**Output**:

| EVENT\_ID | EXTRACTED\_HOST\_LOWERCASE                      |
| --------- | ----------------------------------------------- |
| 101       | <[www.example.co.uk](http://www.example.co.uk)> |

### Example 4: Host extraction from a URL with multiple suffixes/paths

**Goal**: Extract the full hostname from a URL that includes subdomains and extended paths.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter extracted_host_path = extract_url_host("https://www.test.paloaltonetworks.com/suffix/another_suffix") 
| fields event_id, extracted_host_path 
| limit 1 
```

**Explanation**: The function correctly identifies the entire host, including subdomains, regardless of the trailing path components.

**Output**:

| EVENT\_ID | EXTRACTED\_HOST\_PATH                                                 |
| --------- | --------------------------------------------------------------------- |
| 101       | [www.test.paloaltonetworks.com](http://www.test.paloaltonetworks.com) |

### Example 5: Handling NULL input

**Goal**: Demonstrate the function's behavior when provided with a NULL input.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter null_url_input = NULL 
| alter extracted_host_from_null = extract_url_host(null_url_input) 
| fields event_id, null_url_input, extracted_host_from_null 
| limit 1 
```

**Explanation**: Consistent with standard XQL function behavior, if the input to `extract_url_host()` is NULL, the function returns NULL.

**Output**:

| EVENT\_ID | NULL\_URL\_INPUT | EXTRACTED\_HOST\_FROM\_NULL |
| --------- | ---------------- | --------------------------- |
| 101       | NULL             | NULL                        |

### Example: Host extraction from a URL string

**Goal**: Return a single record from the `sample_xql_raw` dataset showing the extracted host name from a specific URL string ("<https://www.test.paloaltonetworks.com>").

**XQL Code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter url_host = extract_url_host("https://www.test.paloaltonetworks.com") 
| fields url_host 
| limit 1
```

**Explanation**:

1. The query starts by accessing the xdr\_data dataset.
2. The alter stage creates a new field named url\_host.
3. The extract\_url\_host() function parses the provided URL string and isolates the host component ([www.test.paloaltonetworks.com](http://www.test.paloaltonetworks.com)).
4. The fields stage restricts the final output to only show the newly created url\_host column.
5. The limit 1 stage ensures that only a single result is returned.

**Output**:

| url\_host                                                               |
| ----------------------------------------------------------------------- |
| "[www.test.paloaltonetworks.com](http://www.test.paloaltonetworks.com)" |

## Related articles

* **Stages**: [`alter`](/xql-command-reference-guide/readme/stages/alter.md), [`config`](/xql-command-reference-guide/readme/stages/config.md), [`fields`](/xql-command-reference-guide/readme/stages/fields.md), [`limit`](/xql-command-reference-guide/readme/stages/limit.md)
* **Functions**: [`extract_url_pub_suffix`](/xql-command-reference-guide/readme/functions/extract_url_pub_suffix.md), [`extract_url_registered_domain`](/xql-command-reference-guide/readme/functions/extract_url_registered_domain.md)
* **Datasets**: [`xdr_data`](https://www.google.com/search?q=%5Bhttps://docs-cortex.paloaltonetworks.com/r/Cortex-XQL-Schema-Reference-Guide/Introduction%5D\(https://docs-cortex.paloaltonetworks.com/r/Cortex-XQL-Schema-Reference-Guide/Introduction\))


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/extract_url_host.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.