topic Re: Regex not extracting host in Splunk Cloud Platform

Regex not extracting host

abhi04 — Wed, 01 May 2024 13:19:49 GMT

Hi all,

our regex is unable to extract host from the logs, can you pleas ehelp with the correct regex.though this regex works when checked in regex101, not sure why unable to extract

[hostextract]
REGEX = ^.*\w+\s+\d+\s+(?:\d+:){2}\d+\s+(?P<test>\w+)\s+
SOURCE_KEY = _raw
DEST_KEY = MetaData:Host
FORMAT = host::$1

e.g. logs format

May 1 08:35:30 10.98.6.249 May 1 08:35:30 host_abc

Apr 10 08:45:20 10.98.6.249 Apr 10 08:45:20 host_def

May 1 08:35:30 10.98.6.249 May 1 08:35:30 host_ghi

Re: Regex not extracting host

abhi04 — Wed, 01 May 2024 13:23:55 GMT

The starting format of logs in regex101

Re: Regex not extracting host

kiran_panchavat — Wed, 01 May 2024 14:52:38 GMT

@abhi04 Hello Abhi, Please use the below regex.

Does my answer above solve your question? If yes, spare a moment to accept the answer and vote for it. Thanks.