topic REGEX pattern to extract the hostname in transforms.conf in Splunk Search

REGEX pattern to extract the hostname in transforms.conf

dhavamanis — Fri, 01 Aug 2014 19:58:02 GMT

Please provide the REGEX pattern to extract from host and assign the value to index name, In the below example, we need to extract the value ABC and assign this to Index..

[generic_idx_routing]
SOURCE_KEY = MetaData:Host
REGEX = (ABC)\\.zxy\\.1a1\\.com
DEST_KEY = _MetaData:Index
FORMAT = $1

Re: REGEX pattern to extract the hostname in transforms.conf

somesoni2 — Fri, 01 Aug 2014 20:16:07 GMT

Have a look at the similar question.
http://answers.splunk.com/answers/1026/route-data-to-index-based-on-host

Re: REGEX pattern to extract the hostname in transforms.conf

yannK — Fri, 01 Aug 2014 20:29:35 GMT

Are you trying to extract the first part of an hostname ?

host.domain.com -> host
host.subdomain.domain.com -> host
host -> host
host.com -> host
192.168.5.2 -> 192

please try
REGEX= ^([^\.]*)