topic Re: Regex to extract for fqdn in Getting Data In

Regex to extract for fqdn

jaydee12 — Wed, 04 Aug 2021 00:57:46 GMT

Hi - Was looking for some assistance in extracting the FQDNs from the paths below:

/var/log/remote/ldap.inftech.net/2021-08-03/auth.log
/var/log/remote/web-proxy-01.int.inftech.net/2021-08-03/proxy.log
/var/log/remote/ns01.inftech.net/2021-08-03/named.log

Regex isn't my strongest area, and one of the domains has an additional level, which makes it that much harder for me.

Re: Regex to extract for fqdn

venkatasri — Wed, 04 Aug 2021 01:11:06 GMT

Hi @jaydee12

try this,

<your_search_goes_here> | rex field=<your_field_name> "var\/log\/remote\/(?<fqdn>.+?)\/"

Re: Regex to extract for fqdn

jaydee12 — Wed, 04 Aug 2021 01:26:26 GMT

HI @venkatasri - Thanks for the quick reply. No, I wasn't able to get that to work. Basically what I am trying to do is extract the FQDN hostname so that I can use it in my input.conf file.

Similar to what this guy is doing:

https://community.splunk.com/t5/Getting-Data-In/Help-extracting-hostname-with-host-regex-from-path/m-p/478981

Re: Regex to extract for fqdn

venkatasri — Wed, 04 Aug 2021 01:43:33 GMT

@jaydee12 Rex looks fine see below. commands before | rex for testing you shall replace with your own search.

Re: Regex to extract for fqdn

jaydee12 — Wed, 04 Aug 2021 02:05:30 GMT

Yes, you are correct...that did work, Greatly appreciate your help!