topic Re: Regex help in Splunk Search

Regex help

ytanaka — Mon, 28 Sep 2020 15:17:33 GMT

Hi,

I am new to splunk and regex, sorry for poor knowledge.

I am trying to extract hostname from
/var/log/syslog/2013/11/14/hostname_messages.log
So far I came up with [a-zA-Z]*([^]+).log$ but this result has _messages.log.
How Can I get rid of this part?

Re: Regex help

gmor — Fri, 15 Nov 2013 14:37:11 GMT

How about:

/([a-zA-Z0-9]+)_messages\.log

Assuming that 'hostname' only contains alpha-numeric characters.

Or, if your 'hostname' doesn't include underscores:

/([^_/]+)_messages\.log

You need to 'escape' the period character, as it has a special meaning in regex.

Re: Regex help

somesoni2 — Fri, 15 Nov 2013 14:50:12 GMT

This should work for you. This takes anything between last "/" and "_".

".*/(?<host>[^_]+)"

Re: Regex help

dmaislin_splunk — Fri, 15 Nov 2013 15:06:34 GMT

.+/(?<hostname>.+?)\_

Re: Regex help

gmor — Fri, 15 Nov 2013 15:10:50 GMT

Are you trying to extract the hostname as part of an input, in inputs.conf or are you trying the use the 'rex' command in the Search App?

Re: Regex help

ytanaka — Fri, 15 Nov 2013 22:32:14 GMT

This works like a charm!!
So this is using variable.
Thanks a lot!

Re: Regex help

dmaislin_splunk — Fri, 15 Nov 2013 22:38:52 GMT

No problem. Please check the checkmark next to this post to accept the answer. Thanks!