topic Regex for host field inputs.conf in Splunk Search

Regex for host field inputs.conf

conner9 — Thu, 09 Aug 2012 00:17:21 GMT

Anyone with ideas on how to convert this rex search string into host_regex= input for the Host field, to be a host name in inputs.conf.

rex "(?P<App>\S+)__(?P<Loc>\S+)__(?P<Host>\S+)__(?P<PID>\d+)."

Re: Regex for host field inputs.conf

hexx — Thu, 09 Aug 2012 04:02:22 GMT

It's not really possible to answer your question without a data sample showing a string from which you want to extract the value of 'host'. Also, is that string going to be found in the 'source' field of the event?

Re: Regex for host field inputs.conf

conner9 — Thu, 09 Aug 2012 22:01:41 GMT

I know it's a wreck, just looking for good ideas.

Here are some of the myriad of possibilities:

timing_manager_main____iccsfwint0001__13618.term
HOSTNAME=iccsfwin0001

target_diag_manager__optical__iccsint0001.log
HOSTNAME=iccsint0001

target_diag_manager__Video__main-frame-int1__8783.term

HOSTNAME=main-frame-int1

target_area_manager____main-frame-int2.log2
HOSTNAME=main-frame-int2

Timing_FEP____its-master2.log
HOSTNAME=its-master2

Re: Regex for host field inputs.conf

hexx — Thu, 09 Aug 2012 22:55:13 GMT

This is helpful, but just to be clear : These strings are part of the path to the source file?

Re: Regex for host field inputs.conf

conner9 — Thu, 09 Aug 2012 23:03:42 GMT

Nah, I wish it was that easy, these are the actual file names that I'm trying to extract the hostname from.

Re: Regex for host field inputs.conf

hexx — Thu, 09 Aug 2012 23:07:17 GMT

That's ok, when I said "path" I was being inclusive of the file name.

Re: Regex for host field inputs.conf

hexx — Thu, 09 Aug 2012 23:15:12 GMT

I would suggest:

host_regex = _+([^_]+)(?:__\d+)?\.\w+$

...but you should really test this out against some data samples before rolling it out to production.

Re: Regex for host field inputs.conf

conner9 — Tue, 11 Sep 2012 20:08:38 GMT

Seems to be working perfectly, Thanks so much for the help.