topic Need help with REX, PLEASE in Splunk Search

Need help with REX, PLEASE

nathbe01 — Fri, 12 Jun 2020 16:43:30 GMT

Hello, I am new to using REX wich is I believe is what I need. I have a field that has data that looks like this...

10.231.247.162--WTLDNDAA001--Can't ping DSLAM
10.44.69.250--TCSUAZMS--VisibilityOnly--Can't ping DSLAM
10.44.69.250--TCSUAZMS--Can't ping DSLAM--VisibilityOnly
172.31.247.148--CLSPCO32H01.2--Can't ping DSLAM
172.31.166.155--RSBGORBU--Can't ping DSLAM

I want my table to ONLY show whats between the hyphens

Example I want to get
WTLDNDAA-001

TCSUAZMS

CLSPCO32H01.2

RSBGORBU

Can anybody help me with creating a rex that removes everything not between the the 2 sets of hyphens.

Would be greatly appreciated!!

Re: Need help with REX, PLEASE

bshuler_splunk — Fri, 12 Jun 2020 17:04:32 GMT

The regex I would use is :

--(?<myfield>[^-\n]+)--

You can see it in action here:

https://regex101.com/r/AbOMKk/1

or you can test it with SPL here:

| makeresults | eval data=split("10.231.247.162--WTLDNDAA001--Can't ping DSLAM%%10.44.69.250--TCSUAZMS--VisibilityOnly--Can't ping DSLAM%%10.44.69.250--TCSUAZMS--Can't ping DSLAM--VisibilityOnly%%172.31.247.148--CLSPCO32H01.2--Can't ping DSLAM%%172.31.166.155--RSBGORBU--Can't ping DSLAM", "%%")| mvexpand data | rex field=data "--(?<myfield>[^-\n]+)--"

but as this looks like you are extracting the host, I would recommend using a props/transforms combination:

props.conf

[mysourcetype]
TRANSFORMS-hostoverride=mysourcetype_hostoverride

transforms.conf

[mysourcetype_hostoverride]
DEST_KEY = MetaData:Host
REGEX = ^\d+\.\d+\.\d+\.\d+--(?<myfield>[^-\n]+)--
FORMAT = host::$1

This regex can be tested here:

https://regex101.com/r/AbOMKk/2

Re: Need help with REX, PLEASE

nathbe01 — Fri, 12 Jun 2020 17:15:31 GMT

That worked, Thank you