topic Finding hostnames in Splunk Search

Finding hostnames

kesvanaidoo — Mon, 08 Mar 2021 19:53:50 GMT

Hello

I am trying to using regex to search a hostname that begins with WB has a 13 characters, character number 10 is the "I" character, the last three characters are numbers. 001 - 099.

Thanks

Re: Finding hostnames

richgalloway — Mon, 08 Mar 2021 21:36:53 GMT

It's not clear is the leading "WB" is part of the 13 characters or not. I'll assume it is not. It's also not clear if character number 10 is lower-case ell or upper-case eye. I've assumed the latter. If either assumption is incorrect then this regex will need to be adjusted.

| regex "WB.{9}I\d{3}"

Re: Finding hostnames

kesvanaidoo — Mon, 08 Mar 2021 21:41:55 GMT

Hello;

Thanks for responding.

The leading WB is part of the 13 characters. Character number 10 can be upper or lower case

Re: Finding hostnames

richgalloway — Tue, 09 Mar 2021 13:39:10 GMT

That changes the regex slightly.

| regex "WB.{7}[iI]\d{3}"