Need help with Rex Function

Stephen11 — Sat, 10 Oct 2020 00:11:25 GMT

I got a variable called _host_name which = usscic-secfio102.na.xxx.com. I need to derive a variable called host_short which will have the value of usscic-secfio102 -- I use Ruby Regular expression editor to figure out expression to get string i need -- it's ^\w+.\w+ How do I integrate in querty using rex?

index=cisco sourcetype=cisco_asa AND vendor_action=permitted AND host=158.11.333.444 | eval service=transport."/".dest_port| lookup dnslookup ip as host output host as host_name| rex????? | table host_short

Re: Need help with Rex Function

to4kawa — Sat, 10 Oct 2020 00:31:30 GMT

rex field=called _host_name "(?<short_host>[^\.]+)"
how about this?

Re: Need help with Rex Function

Stephen11 — Sun, 11 Oct 2020 20:31:06 GMT

thanks ... that was easy

topic Need help with Rex Function in Splunk Search

Need help with Rex Function

Re: Need help with Rex Function

Re: Need help with Rex Function