topic How to edit my regular expression to retrieve the first 7-8 characters of variable length strings that end with abcd.com? in Getting Data In

How to edit my regular expression to retrieve the first 7-8 characters of variable length strings that end with abcd.com?

christopheryu — Tue, 27 Sep 2016 19:44:06 GMT

I am trying to extract router names from syslog messages.

Need the regular expression to get the first 7 or 8 characters of variable length strings that end with abcd.com. Example below:

tpbjm01-re0.abcd.com
xtsdjm01-re0.abcd.com
lnd2j902-re1.abcd.com
pqrjm02-re1.abcd.com
py3jm01-re1.uk.abcd.com
brhmjm02-re1.emea.abcd.com
rcnj902.abcd.com
cpzyjm01.abcd.com

So result should be:

tpbjm01
xtsdjm01
lnd2j902
pqrjm02
py3jm01
brhmjm02
rcnj902
cpzyjm01

This is supposed to be the correct regex but it is not pulling anything:

^(?\w{7,8})(?=.*abcd.com)

Re: How to edit my regular expression to retrieve the first 7-8 characters of variable length strings that end with abcd.com?

rrowland — Tue, 27 Sep 2016 23:20:54 GMT

Hello Christopher,

I was able to use the following on regex101.com with your data set and get your required results using the below.

([a-zA-Z0-9]{7,8})

Regards,
Rich

Re: How to edit my regular expression to retrieve the first 7-8 characters of variable length strings that end with abcd.com?

christopheryu — Wed, 28 Sep 2016 16:17:31 GMT

Thank you for the response @rrowland . I did use regex101 in coming up with regex in my question but it does not work with splunk. I was able do it by splunk's "extract new field" and using add/remove events. Regex below:

^(?:[^:\n]*:){4}\d+\s+(?P\w+)