topic Re: position of a character in a string in Splunk Search

position of a character in a string

jrodriguezap — Wed, 25 Sep 2013 17:58:23 GMT

Hello
I'm trying to do a substr to strings such as:

google-public-dns-b.google.com
cachewas.tdp.net.pe
b.resolvers.Level3.net

And give me back the following:

google.com
tdp.net.pe
Level3.net

I thought doing a substr(domain,(mvjoin(domain,"."))
But it turned out, that way it could be achieved?
I would appreciate your support.
Regards

Re: position of a character in a string

Ayn — Wed, 25 Sep 2013 18:06:57 GMT

How would you (and thus Splunk) know that the second domain is supposed to be transformed to "tdp.net.pe" and not just "net.pe"?

Re: position of a character in a string

wrangler2x — Wed, 25 Sep 2013 22:31:46 GMT

I'm assuming that you have a field for that FQDN called 'hostname'. If that is not the field name, use what is the field name. If you don't have a field for the FQDN pre-defined, then the answer would be different. This answer assumes you want two levels of the domain name (as in google.com):

... | rex field=hostname "\.(?<s_domainname>\S+\.\S+)$"

Re: position of a character in a string

jrodriguezap — Thu, 26 Sep 2013 18:43:16 GMT

It's very good.
Thank you very much.

Re: position of a character in a string

sowings — Thu, 26 Sep 2013 18:46:10 GMT

.co.uk 😞

I've thought about working on an app to build up the known TLDs in order to get a correct "domain" mapping, but I never got around to it.

Re: position of a character in a string

MonkeyK — Tue, 21 Nov 2017 12:55:57 GMT

old question, but i worked through a similar problem in
This question

Basically, you can use these to get at different subdomain levels

  | rex field=dest_hostname "(?P<ld2>[\w_-]+\.[\w_-]+)$" 
  | rex field=dest_hostname "(?P<ld3>[\w_-]+\.[\w_-]+\.[\w_-]+)$" 
  | rex field=dest_hostname "(?P<ld4>[\w_-]+\.[\w_-]+\.[\w_-]+\.[\w_-]+)$"