topic Re: How can i search for a host wich must have 3 letters at the begin of the dns name ? in Splunk Search

How can i search for a host wich must have 3 letters at the begin of the dns name ?

criedman — Mon, 27 Nov 2017 13:54:18 GMT

Hi,

i want to search for hosts which always have 3 letters at the begin of the dns name.

search:

index="myindex" host="(letter)(letter)(letter)server*"

Result should be:

xxxserver01
aaaserver01
bbbserver01
cccserver01
....

Thanks!
Christoph

Re: How can i search for a host wich must have 3 letters at the begin of the dns name ?

wenthold — Mon, 27 Nov 2017 15:15:24 GMT

You could use regex:

index="myindex" | regex host="^[a-zA-Z]{3}server"

Depending upon what's in "myindex" this is a pretty expensive search, if you can narrow down the results processed by "| regex ..." in any way you should.

Re: How can i search for a host wich must have 3 letters at the begin of the dns name ?

HiroshiSatoh — Mon, 27 Nov 2017 15:39:20 GMT

index="myindex" host="server"|where match(source, "^[a-zA-Z]{3}server.*")

Re: How can i search for a host wich must have 3 letters at the begin of the dns name ?

somesoni2 — Mon, 27 Nov 2017 16:34:19 GMT

The regex command expects full regular expression representation of the values of the field, so you would want to add a .+ at the end after server to incorporate those numbers at the end of host names.

Re: How can i search for a host wich must have 3 letters at the begin of the dns name ?

wenthold — Mon, 27 Nov 2017 16:52:44 GMT

I ran a test search on 6.5.5 without doing the full field match and it worked, and I don't see that requirement in the search manual:

search reference - regex

Am I missing something?

Re: How can i search for a host wich must have 3 letters at the begin of the dns name ?

somesoni2 — Mon, 27 Nov 2017 16:59:34 GMT

Actually I take that back. I can swear it didn't work for me in some version. May be my memory needs updates.

Re: How can i search for a host wich must have 3 letters at the begin of the dns name ?

criedman — Tue, 28 Nov 2017 07:46:31 GMT

Hi,

thank you thats the perfect solution for me =).

| where match(source, "^[a-zA-Z]{3}server.*")

Result:
The result must contain 3 letters before "server".

xxxserveryyy

Thanks
Christoph