topic Matching A vs AAAA rex help in Splunk Search

Matching A vs AAAA rex help

dondky — Mon, 21 Oct 2013 16:59:10 GMT

All,

I'm stuck on a regex issue. Not sure how I can match A records vs AAAA records within windows dns logs. I came up with the following:

sourcetype=windns* | rex "NOERROR]\s(?(?:A|PTR|SRV|TXT|AAAA))\s" | table record_type

However, my AAAA records don't return, I'm thinking this is because the A is matched and the match stops there. How would one match A and AAAA records?

Here is a sample data set:

20131021 12:24:06 1190 PACKET 05D2B130 UDP Rcv 192.168.x.x e31f Q [0001 D NOERROR] A test.example.com
20131021 12:24:06 1190 PACKET 1D4EE140 UDP Rcv 192.168.x.x 3d6d Q [0001 D NOERROR] AAAA test.example.com

Any pointers or assistance would be helpful.

Thanks

Re: Matching A vs AAAA rex help

richgalloway — Mon, 21 Oct 2013 17:07:47 GMT

Why be so specific? Just take everything between "NOERROR]" and the DNS name as the record type.

| rex "NOERROR]\s(?<record_type>.*?)\s" |

If you only want to see specific record types, use a where clause after the rex.

Re: Matching A vs AAAA rex help

dondky — Mon, 21 Oct 2013 17:07:59 GMT

Might be answering my own question but I think I found a solution with the following:

sourcetype=windns* | rex "NOERROR]\s(?<record_type>(?:A|PTR|SRV|TXT|\bAAAA\b))\s" | table record_type. Still open to how others would solve this though.

Re: Matching A vs AAAA rex help

dondky — Mon, 21 Oct 2013 17:16:27 GMT

Wow, this is much better I tried .* route but never added the ? hence I went the specific route. Thanks for pointing this out.

Re: Matching A vs AAAA rex help

richgalloway — Mon, 21 Oct 2013 17:24:31 GMT

Please accept this answer if it solves your problem.