topic Re: Reverse-order a DNS at search time in Getting Data In

Reverse-order a DNS at search time

ahamilton — Thu, 13 Feb 2014 17:21:42 GMT

Hi all,

In certain search, Splunk returns DNS hostnames, for example:
a.monetate.net.akadns.net
evsecure-ocsp.verisign.com

To facilitate sorting, I'd like to have the names displayed in reverse order across the dots, e.g.:
net.akadns.net.monetate.a
com.verisign.evsecure-ocsp

I've found some examples that suggest how to change word order but Splunk rejects it during search:

sourcetype=dns | rex field=domain mode=sed "s/\n/!G;s/\(.\)\(.*\n\)/&\2\1/;//D;s/.//"

Yields: Error in 'rex' command: Failed to initialize sed. Invalid option string: (.)(.*\n)/&\2\1/;//D;s/.//

Ideas?

folkstalk [dot] com/2011/12/methods-to-reverse-string-using-unix.html
programmingforums [dot] org/post188712.html

Re: Reverse-order a DNS at search time

yplambert — Thu, 06 Mar 2014 19:01:34 GMT

I've not written it yet, but my plan to handle this is to write a dynamic lookup that does the equivalent of this (in perl):

$sortable_name=$hostname;
$sortable_name=~s{(\d+)}{sprintf "%09d", $1}g;
$sortable_name=join('.', reverse(split(/\./, $sortable_name)));
return $sortable_name;

So given a field with the hostname, it'd return a new field with a "sortable name." You could sort on that field, and then remove it from the results.

Re: Reverse-order a DNS at search time

matthewg — Tue, 02 Jul 2024 20:35:30 GMT

Starting with a field: domain, you can do the following:

| eval domain_reversed=split(domain,".")
| eval domain_reversed=mvreverse(domain_reversed)
| eval domain_reversed=mvjoin(domain_reversed,".")
| sort domain_reversed

This splits the field into a multivalued field called domain_reversed with the values separated by the dot, then reverses the order of the resulting multivalued field, then joins the results back together and sorts on the resulting field.