topic Re: How do I write the regex to extract a DNS domain field from my sample data? in Splunk Search

How do I write the regex to extract a DNS domain field from my sample data?

OMohi — Sun, 08 Nov 2015 23:41:27 GMT

Hi :

I need help extracting the domain IP address for the DNS logs. The automatic field extractor does not work in my case.

Here is the sample raw file:

11/8/2015 5:17:24 PM 1A5C PACKET  000000B9E66AE560 UDP Rcv 10.230.138.230  9bf2   Q [1001   D   NOERROR] AAAA   access-qa.truvenhealth.com

I need splunk to extract access-qa.truvenhealth.com as a field. I am unable to do so because the regex pattern doesn't fit it well.

Re: How do I write the regex to extract a DNS domain field from my sample data?

adauria_splunk — Mon, 09 Nov 2015 00:25:30 GMT

How about keying the regex off the closing bracket? Try:

(Base search)| rex "\]\s+\w+\s+(?<dns_domain>.*)"

Re: How do I write the regex to extract a DNS domain field from my sample data?

woodcock — Mon, 09 Nov 2015 06:12:31 GMT

If it is always the last thing, then like this:

... | rex "(?<dns_domain>[\S]+)$"

Re: How do I write the regex to extract a DNS domain field from my sample data?

woodcock — Mon, 09 Nov 2015 15:50:53 GMT

This is interesting; I understand that both answers work and are correct but it is not supposed to be possible to Accept more than 1 answer. @OMohi, how were you able to do this?

Re: How do I write the regex to extract a DNS domain field from my sample data?

dkadavis — Tue, 25 Jun 2019 18:44:39 GMT

Like this:

(?\w+)\.(?.*)

Re: How do I write the regex to extract a DNS domain field from my sample data?

dkadavis — Tue, 25 Jun 2019 18:48:31 GMT

Since the original post did not keep all the information I've updated this to reflect the correct statements and added one just in case you have additional characters in the name.

| rex field="dnsName" "(?<name_Host_Dns>\w+)\.(?<name_Domain_Dns>.*)"

| rex field="dnsName" "(?<name_Host_Dns>[a-zA-Z0-9-_]+)\.(?<name_Domain_Dns>.*)"

Optionally you can do this

| rex field="dnsname" "(?<dnsdomain>\..*)"
| eval dnshostname = replace('dnsname',dnsdomain',"")
| eval dnsdomain = replace(dnsdomain,"^.{1}","")

Re: How do I write the regex to extract a DNS domain field from my sample data?

woodcock — Tue, 25 Jun 2019 18:51:08 GMT

Use markdown:
https://answers.splunk.com/static/markdown/help.html

Re: How do I write the regex to extract a DNS domain field from my sample data?

woodcock — Tue, 25 Jun 2019 19:12:14 GMT

I added code-markdown. Go in and keep the leading spaces and fix it the way that it should look and it will stick.

Re: How do I write the regex to extract a DNS domain field from my sample data?

jnudell_2 — Tue, 25 Jun 2019 19:15:29 GMT

Why complicate it? Just anchor it to the end like @woodcock suggested.

Re: How do I write the regex to extract a DNS domain field from my sample data?

dkadavis — Tue, 25 Jun 2019 19:50:49 GMT

Thanks for the assist.