topic Re: Field Extraction - Hostname with inconsistent in Splunk Search

Field Extraction - Hostname with inconsistent

jpsheridan — Thu, 22 Oct 2020 17:32:39 GMT

I'm trying to do a field extraction for a hostname field that has some inconsistency with the format.

There are two types of formats for the hostname field and they can be in upper or lower, i need them in lower.

DOMAIN\hostname or hostname.xxxx.xx.xxx

Previously, I was replacing what I didn't want in that field , lowering that eval in order to join to a lookup table. What I'm trying to do now is a field extraction from that hostname field check for both formats and then removes DOMAIN\ or the .xxxxx.xx.xxx fqdn format from the end.

My REX commands that I'm using:

| rex field=hostname "DOMAIN\\\(?P<ComputerName>.*)"

|rex field=hostname "^(?<ComputerName>[^\.]+)"

Any help would be appreciated!

Re: Field Extraction - Hostname with inconsistent

richgalloway — Thu, 22 Oct 2020 19:16:26 GMT

What results are you getting from your current search? What results do you want?

It would help to see some sample data.

Re: Field Extraction - Hostname with inconsistent

jpsheridan — Thu, 22 Oct 2020 20:06:23 GMT

I will get a mix of hostnames in these two formats:

DOMAIN\hostname

hostname.xxxxx.xx.xxxx

DOMAIN and the x's are just from their fqdn. Some are upper and some are lower and the source is coming from a 3rd party system. I just want to pull the hostname in lower case for a field extraction.

Re: Field Extraction - Hostname with inconsistent

ITWhisperer — Fri, 23 Oct 2020 09:01:42 GMT

What is wrong with the two rex you already have (apart from perhaps too many backslashes?)?

Re: Field Extraction - Hostname with inconsistent

vnravikumar — Fri, 23 Oct 2020 09:31:44 GMT

Try this

| makeresults | eval hostname = "DOMAIN\host1,host2.xxxx.xx.xxxx" | makemv delim="," hostname | mvexpand hostname | rex field=hostname "(DOMAIN\\\){0,1}(?P<host>[^.]+)"