topic Splunk wildcard for specific position of character in a host list in Splunk Search

Splunk wildcard for specific position of character in a host list

utk123 — Tue, 22 Jun 2021 15:02:26 GMT

I have a table with more than 50000 hostnames. I want to run a wild card for 5th & 6th character in a hostname list.

My list sample:

hostname

SERVINBBB01

SERRCNAAA01

SERSSPBBC55

SERRINAAC98

SERWINSSS11

In my search result, I want to get list of hosts with IN in 5th & 6th location.

Results should be:

hostname

SERVINBBB01

SERRINAAC98

SERWINSSS11

With asterisk(*) (example: *IN*) I am not able to get these results, as characters before and after 5th, 6th position are not same always.

Re: Splunk wildcard for specific position of character in a host list

kamlesh_vaghela — Tue, 22 Jun 2021 15:12:05 GMT

@utk123

Can you please try this?

YOUR_SEARCH | regex hostname="(?<=^.{4})IN"

My Sample Search :

| makeresults | eval _raw="hostname SERVINBBB01 SERRCNAAA01 SERSSPBBC55 SERRINAAC98 SERWINSSS11 "| multikv forceheader=1 | table hostname | regex hostname="(?<=^.{4})IN"

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: Splunk wildcard for specific position of character in a host list

utk123 — Wed, 23 Jun 2021 02:37:35 GMT

Thanks KV, that works perfect.