topic How to extract host field values with regex? in Splunk Search

How to extract host field values with regex?

Raghav2384 — Mon, 28 Sep 2020 17:07:05 GMT

Hello Experts,

I am trying to extract hosts from the following in 2 ways
15 21:26:18 cmflouxy005.sample.xy.com storage_config_info[15580]: GETIT_Store_Reflection_data|INQ|cmflouxy005|/dev/rdsk/A3x5000097408315E90d63s2|000292603159|2606|R1|9437760
Approach # 1: i tried (^.*?\d{2}:d{2}:d{2})\s(?\S+)" this gives me cmflouxy005.sample.xy.com but i need 'cmflouxy005' only.

Approach # 2: Can you also help me how to extract the host value that's between the pipes on second line? by knowing both the ways, i am hoping to get a good understanding of regex and extractions involving special chars.

Another roadblock: sometimes i have IP addresses in place of FQDN in the logs.
Thanks in advance,
Raghav

Re: How to extract host field values with regex?

musskopf — Fri, 18 Jul 2014 03:34:26 GMT

You could use like this, didn't test 100% but it should select the IP or the first part of the FQDN.

^\d+\s\d{2}:\d{2}:\d{2}\s(?<hostname>((\d+\.\d+\.\d+\.\d+|\w+)))

for the second line, with the Pipes, you can use:

^\w+\|\w+\|(?<hostname>(\d+\.\d+\.\d+\.\d+|\w+))

If you have the both lines on the same sourcetype, you probably want to give different names to the extracted fields.

Btw, this is a good site to test RegExps:
http://regex101.com/#pcre

Re: How to extract host field values with regex?

esix_splunk — Fri, 18 Jul 2014 04:42:30 GMT

For capturing IP, \d+ will work fine. This is probably a better example in terms of regex and not being greedy-

^\d+\s\d{2}:\d{2}:\d{2}\s(?<host>(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})|\w+)

And is that log actually two lines, or is it one single line event? In the later case, the second regex needs to be changed.. The below will look for the second occurrence of '|' from the beginning of the line and capture the word after that.

^(?:[^|]*\|){2}(?<hostname>\w[^|]*)

Cheers.

Re: How to extract host field values with regex?

Raghav2384 — Sat, 19 Jul 2014 17:49:04 GMT

using d{1,3} instead of d+did the magic. Thank you

Re: How to extract host field values with regex?

Raghav2384 — Sat, 19 Jul 2014 17:50:12 GMT

it worked after i changed \d+ to \d{1,3}. For some reason the field doesn't appear in interesting fields area if i use \d+. Do you know the reason?

Thank you for the link and appreciate you help.

Re: How to extract host field values with regex?

esix_splunk — Sun, 20 Jul 2014 01:53:24 GMT

d+ is a greedy search in regex. So it will return 0 to infinite numbers. Ip addresses do have constraints d{1,3}. So I would image the pattern matching in your data without a proper regex wouldnt identify it properly.