Combining Splunk ITSI regular expression SPL?

AnushaJone — Wed, 10 May 2023 19:55:20 GMT

I need help to combine line 1 and 2 make it as one regular expression line in SPL query

1. | rex "(?<object>gov\.usda\.fsa\.[^\s]+)"
2. | eval object=split(coalesce(object, "NA"),"."),object=mvindex(object,-1)

Please help!

Re: Splunk ITSI regular expression SPL

yeahnah — Wed, 10 May 2023 04:35:15 GMT

Hi @AnushaJone

You've not provided any example the raw event and the expected outcome of the rex. So, assuming you are looking for the top-level domain each time, then here is a run anywhere example of what to do...

So the last rex line gives the same result and the rex and eval above. However, maybe you're looking for something more generic ¯\_(ツ)_/¯

Hope it helps

topic Combining Splunk ITSI regular expression SPL? in Splunk ITSI

Combining Splunk ITSI regular expression SPL?

Re: Splunk ITSI regular expression SPL