https://community.splunk.com/t5/Splunk-Search/How-to-figure-out-the-exact-regex-to-capture-the-hostname-value/m-p/422490#M121306 <P>hey the above regex capture both <STRONG>vsys1,dwest01fw</STRONG> , need a regex to capture only this value <STRONG>dwest01fw</STRONG> from the event data. </P> <P>Sample data:<BR /> May 29 14:51:56 deast01pano.xxxxx.com 1,2018/05/29 14:51:56,012501001022,6553964590112973819,0x8000000000000000,USERID,login,2049,2018/05/29 14:51:50,0,0,0,0,vsys1,dwest01fw,1,vsys1,10.142.10.172,xxxxx\pulse,deast01fwua.xxxxx.com,0,1,2700,0,0,agent,,0,0,,2018/05/29 14:51:47,1,0,0,0x0,xxxxx\pulse</P> Tue, 29 May 2018 16:32:29 GMT Hemnaath 2018-05-29T16:32:29Z https://community.splunk.com/t5/Splunk-Search/How-to-figure-out-the-exact-regex-to-capture-the-hostname-value/m-p/422488#M121304 <P>Hi, I'm sure this is really simple but I've been unable to figure out the exact regex to capture the hostname value from the event logs. </P> <P>Sample data:</P> <PRE><CODE>May 29 14:51:56 deast01pano.xxxxx.com 1,2018/05/29 14:51:56,012501001022,6553964590112973819,0x8000000000000000,USERID,login,2049,2018/05/29 14:51:50,0,0,0,0,vsys1,dwest01fw,1,vsys1,10.142.10.172,xxxxx\pulse,deast01fwua.xxxxx.com,0,1,2700,0,0,agent,,0,0,,2018/05/29 14:51:47,1,0,0,0x0,xxxxx\pulse </CODE></PRE> <P>I want to capture <STRONG>dwest01fw</STRONG> and replace it in the host field. I tried this regex and tested in regex101.com but it failed to capture the host .</P> <PRE><CODE>USERID,.+,vsys1,(\w+).+$ </CODE></PRE> <P>Transform syntax :</P> <PRE><CODE>[pan_vsys1_host] REGEX = USERID,.+,vsys1,(\w+).+$ DEST_KEY = MetaData:Host FORMAT = host::$1 </CODE></PRE> <P>Kindly guide me on this.</P> Tue, 29 May 2018 16:14:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-figure-out-the-exact-regex-to-capture-the-hostname-value/m-p/422488#M121304 Hemnaath 2018-05-29T16:14:14Z https://community.splunk.com/t5/Splunk-Search/How-to-figure-out-the-exact-regex-to-capture-the-hostname-value/m-p/422489#M121305 <P>Give this a try</P> <PRE><CODE>[pan_vsys1_host] REGEX = USERID,([^,]+,){8}(\w+) DEST_KEY = MetaData:Host FORMAT = host::$2 </CODE></PRE> <P><A href="https://regex101.com/r/hn695t/1">https://regex101.com/r/hn695t/1</A></P> Tue, 29 May 2018 16:24:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-figure-out-the-exact-regex-to-capture-the-hostname-value/m-p/422489#M121305 somesoni2 2018-05-29T16:24:07Z https://community.splunk.com/t5/Splunk-Search/How-to-figure-out-the-exact-regex-to-capture-the-hostname-value/m-p/422490#M121306 <P>hey the above regex capture both <STRONG>vsys1,dwest01fw</STRONG> , need a regex to capture only this value <STRONG>dwest01fw</STRONG> from the event data. </P> <P>Sample data:<BR /> May 29 14:51:56 deast01pano.xxxxx.com 1,2018/05/29 14:51:56,012501001022,6553964590112973819,0x8000000000000000,USERID,login,2049,2018/05/29 14:51:50,0,0,0,0,vsys1,dwest01fw,1,vsys1,10.142.10.172,xxxxx\pulse,deast01fwua.xxxxx.com,0,1,2700,0,0,agent,,0,0,,2018/05/29 14:51:47,1,0,0,0x0,xxxxx\pulse</P> Tue, 29 May 2018 16:32:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-figure-out-the-exact-regex-to-capture-the-hostname-value/m-p/422490#M121306 Hemnaath 2018-05-29T16:32:29Z https://community.splunk.com/t5/Splunk-Search/How-to-figure-out-the-exact-regex-to-capture-the-hostname-value/m-p/422491#M121307 <P>Hey, what @somesoni2 posted will work fine. The first capture group captures the <CODE>vsys1</CODE>, the second one captures the <CODE>dwest01fw</CODE>, but only the second one is then used in the FORMAT line.</P> <P>You could also use this:<BR /> <A href="https://regex101.com/r/6U1pkt/1">https://regex101.com/r/6U1pkt/1</A><BR /> You would have to use $1 in the FORMAT line. Both solutions should work fine. </P> Tue, 29 May 2018 16:55:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-figure-out-the-exact-regex-to-capture-the-hostname-value/m-p/422491#M121307 xpac 2018-05-29T16:55:28Z