topic Re: regex difficulty with host / path discrimination in Splunk Search

regex difficulty with host / path discrimination

tyronetv — Thu, 01 May 2014 15:10:30 GMT

I have a log file that has the host as either an IP address OR a FQDN. This is easy, right. Nope. The format can be:

192.168.1.1/inbox/to/file

or

192 .168.1.1inbox/to/another-file

or

host.com/inbox/to/file

or

host.cominbox/to/another-file

I can regex the ip easy enough \d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}

so that handles the first two . .

For the third one, I can do a greedy up to / [^/]+

problem is the last one, actually...

The perfect solution would be one regex for the extract regardless. Written out it would be:

everything up to either / or the word 'inbox'

That way, I can do the extract as :

(?<HOST>(provided regex))

Thanks!

The full entry is gathered by:

^\d{4}.\d{2}.\d{2}\s\d{2}:\d{2}\s(?<Transmissionformat>\w)\s(<Fileone>[^-]+)\s(?<DIRECTION>\S{3})\s(?<HOST>???????)(?<Filetwo>[^$]+)$

I need the ???? part replaced with a regex that will do as described above.

2014.04.28 14:10 B n:\path\one\to\fileone <-- 172.21.1.2Inbox/path/filetwo

Re: regex difficulty with host / path discrimination

somesoni2 — Thu, 01 May 2014 16:11:29 GMT

This works with your sample data.

|stats count |fields - count | eval host="192.168.1.1/inbox/to/file,192 .168.1.1inbox/to/another-file,host.com/inbox/to/file,host.cominbox/to/another-file" | eval host=split(host,",") | mvexpand host | rex field=host "^(?<hostName>[^/]*)(/)*inbox"

Re: regex difficulty with host / path discrimination

tyronetv — Thu, 01 May 2014 17:35:05 GMT

(?<HOST>[^/(?<!Ii)]+)

That sort of works.. but concerned if the FQDN has an 'i' in it.

Re: regex difficulty with host / path discrimination

somesoni2 — Mon, 28 Sep 2020 16:30:53 GMT

Tried this and worked fine.