topic extract host name from field in Knowledge Management

extract host name from field

splunkuseradmin — Tue, 29 Sep 2020 23:52:37 GMT

Hi everybody

I wanted to extract all hostname from this field "local_address" and save in a new field call "host" so that i only get the hostnames after "@"
I believe we can do it by "search | spath | rex field=local_address "@(?P[^-]+)"| stats count by _time host"
please corerct this.
below is the exact field

local_address
14081300@abc3-def-ghi1101.jklm.opqr.com
13546330@wer2-gre-oug1201.jklm.opqr.com
thanks

Re: extract host name from field

harsmarvania57 — Tue, 26 Mar 2019 20:08:46 GMT

Hi,

You can try below search

<yourBaseSearch>
| spath
| rex field=local_address "\@(?<ext_host>[^\h]*)"
| stats count by ext_host,_time

Re: extract host name from field

harsmarvania57 — Tue, 26 Mar 2019 20:12:27 GMT

If local_address is multi-valued field then you can try below query

<yourBaseSearch>
| spath
| rex field=local_address "\@(?<ext_host>[^\v]*)" max_match=0
| mvexpand ext_host