topic Re: Need help rewriting DNS log lines in Getting Data In

Need help rewriting DNS log lines

the_wolverine — Wed, 23 Mar 2011 05:17:54 GMT

I have DNS log lines that look like the following:

(4)mail(6)google(3)com(0)
(7)twitter(3)com(0)
(12)spreadsheets(1)l(6)google(3)com(0)

How would I configure rewriting so that Splunk will display them in a more appealing format?

mail.google.com
twitter.com
spreadsheets.l.google.com

Re: Need help rewriting DNS log lines

dwaddle — Wed, 23 Mar 2011 05:22:30 GMT

Can you use rex's sed mode? This may be a little too indiscriminate, but:

blah | rex mode=sed "s/\(\d\)/\./g"

Re: Need help rewriting DNS log lines

the_wolverine — Wed, 23 Mar 2011 05:46:57 GMT

Thank you! It seems you don't need the escape for '.' for some reason -- Ultimately, I will use sedcmd to do this.

Re: Need help rewriting DNS log lines

the_wolverine — Wed, 23 Mar 2011 07:46:57 GMT

props.conf

[dns]
SEDCMD-dns = s/\(\d\)/\./g s/\(\d\d\)/\./g

* Splunk didn't seem to like \d? so I used \d\d for the cases where we have 2 digits: (12)

Re: Need help rewriting DNS log lines

gkanapathy — Wed, 23 Mar 2011 08:42:26 GMT

You need \d+, not \d?. \d? means zero or one digit. If there are never more than two, you can use \d{1,2}

Re: Need help rewriting DNS log lines

the_wolverine — Thu, 24 Mar 2011 23:47:17 GMT

Ah ok, thanks for that. I can streamline that REGEX now 🙂