topic Re: rex command help... in Splunk Search

rex command help...

harishalipaka — Tue, 25 Feb 2020 13:33:46 GMT

Hi All,

my data is like below-- I want to extract when it has string ignore numbers

853727-gcplusrspcndb01.usa.corp.ad
10.198.29.5

Output:-

853727-gcplusrspcndb01
 10.198.29.5

Re: rex command help...

richgalloway — Tue, 25 Feb 2020 13:51:50 GMT

Here's one way.

... | rex "(?<field>[^\.]+)"

Re: rex command help...

gcusello — Tue, 25 Feb 2020 14:08:05 GMT

Hi @harishalipaka,
try this

| rex "^\s+(?<url>[^\.]+).*\s+(?<ip>\d+\.\d+\.\d+\.\d+)"

that you can test at https://regex101.com/r/6axOMx/1

Ciao.
Giuseppe

Re: rex command help...

harishalipaka — Wed, 26 Feb 2020 10:12:27 GMT

Hi @richgalloway

I already tried this logic but it will extract like below

853727-gcplusrspcndb01
10

But i want like this

853727-gcplusrspcndb01
  10.198.29.5

Re: rex command help...

harishalipaka — Wed, 26 Feb 2020 10:17:05 GMT

Hi @gcusello

It is not working for me .am getting empty fields.

| rex field=HostName "^\s+(?<url>[^\.]+).*\s+(?<ip>\d+\.\d+\.\d+\.\d+)"

Re: rex command help...

gcusello — Wed, 26 Feb 2020 10:48:53 GMT

Hi @harishalipaka,
probably your row data are different, this regex is related to the information you shared, could you share an example of your row data?

Ciao.
Giuseppe

Re: rex command help...

to4kawa — Wed, 26 Feb 2020 11:12:47 GMT

| rex mode=sed "s/[.a-z]*$//"