> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/extract_url_pub_suffix.md).

# extract\_url\_pub\_suffix

Use the `extract_url_pub_suffix()` function to return the public suffix of a given URL string (for example, "com", "org", "net").

## Syntax

```sql
extract_url_pub_suffix ("<URL>")
```

## Parameters

| Name    | Type   | Required | Description                                                                                              |
| ------- | ------ | -------- | -------------------------------------------------------------------------------------------------------- |
| `<URL>` | string | Yes      | The input string literal or field containing the URL from which the public suffix needs to be extracted. |

## Returns

The `extract_url_pub_suffix()` function returns a string representing the public suffix of the URL.

## Usage notes

* The function requires a string value representing a URL as input.
* The function always returns the public suffix value in lowercase characters, regardless of the input URL's original casing.
* This function is typically used within the `alter` stage to create new fields or modify existing ones based on extracted URL data, or within the `filter` stage for conditional logic.

## Examples

### Example 1: Basic public suffix extraction from a standard URL

**Goal**: Extract the public suffix from a common HTTPS URL.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter extracted_pub_suffix = extract_url_pub_suffix("https://www.paloaltonetworks.com") 
| fields event_id, extracted_pub_suffix 
| limit 1 
```

**Explanation**: The query extracts "com" as the public suffix from the URL "<https://www.paloaltonetworks.com>".

**Output**:

| EVENT\_ID | EXTRACTED\_PUB\_SUFFIX |
| --------- | ---------------------- |
| 101       | "com"                  |

### Example 2: Public suffix extraction from a URL with multiple suffixes/paths

**Goal**: correctly identify only the public suffix from a URL that includes subdomains and extended paths.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter extracted_pub_suffix_complex = extract_url_pub_suffix("https://www.test.paloaltonetworks.com/suffix/another_suffix") 
| fields event_id, extracted_pub_suffix_complex 
| limit 1 
```

**Explanation**: The function correctly isolates "com" as the public suffix, ignoring subdomains and path components.

**Output**:

| EVENT\_ID | EXTRACTED\_PUB\_SUFFIX\_COMPLEX |
| --------- | ------------------------------- |
| 101       | "com"                           |

### Example 3: Public suffix extraction with mixed-case input

**Goal**: Demonstrate that the function returns the public suffix in lowercase characters, even if the input URL contains uppercase letters.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter extracted_pub_suffix_lowercase = extract_url_pub_suffix("www.Example.Co.UK") 
| fields event_id, extracted_pub_suffix_lowercase 
| limit 1 
```

**Explanation**: Despite "[www.Example.Co.UK](http://www.Example.Co.UK)" having mixed casing, the function returns "uk" in all lowercase, demonstrating its built-in lowercasing behavior.

**Output**:

| EVENT\_ID | EXTRACTED\_PUB\_SUFFIX\_LOWERCASE |
| --------- | --------------------------------- |
| 101       | "uk"                              |

### Example 4: Handling NULL input

**Goal**: Demonstrate the function's behavior when provided with a NULL input.

**XQL code**:

```sql
config timeframe = 1d 
| dataset = sample_xql_raw 
| alter null_url_input = NULL 
| alter extracted_pub_suffix_from_null = extract_url_pub_suffix(null_url_input) 
| fields event_id, null_url_input, extracted_pub_suffix_from_null 
| limit 1 
```

**Explanation**: Consistent with standard XQL function behavior, if the input to `extract_url_pub_suffix()` is NULL, the function returns NULL.

**Output**:

| EVENT\_ID | NULL\_URL\_INPUT | EXTRACTED\_PUB\_SUFFIX\_FROM\_NULL |
| --------- | ---------------- | ---------------------------------- |
| 101       | NULL             | NULL                               |

## Related articles

* **Stages**: [`alter`](/xql-command-reference-guide/readme/stages/alter.md), [`filter`](/xql-command-reference-guide/readme/stages/filter.md)
* **Functions**: [`extract_url_host`](/xql-command-reference-guide/readme/functions/extract_url_host.md), [`extract_url_registered_domain`](/xql-command-reference-guide/readme/functions/extract_url_registered_domain.md)
* **Datasets**: [`xdr_data`](https://www.google.com/search?q=%5Bhttps://docs-cortex.paloaltonetworks.com/r/Cortex-XQL-Schema-Reference-Guide/Introduction%5D\(https://docs-cortex.paloaltonetworks.com/r/Cortex-XQL-Schema-Reference-Guide/Introduction\))


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/extract_url_pub_suffix.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.