topic Re: Regex - DNS formatting in Splunk Search

Regex - DNS formatting

tmarlette — Tue, 15 Mar 2016 18:37:02 GMT

I am attempting to format my DNS data to a standard format. I'm thinking I can use REGEX / SED for the this formatting.

This is my current field value:

(19)espnfivethirtyeight(5)files(9)wordpress(3)com(0)

This is the value that I would like to see:

espnfivethirtyeight.files.wordpress.com

I've used eval to replace the pattern eval myField=replace(src_domain,"\(\d+\)",".") and that replaces the values to the following, and the first and last '.' are adjusting my search results

.espnfivethirtyeight.files.wordpress.com.

Is there anything I can use in order to make the desired adjustment?

Thank you so much!!

Re: Regex - DNS formatting

somesoni2 — Tue, 15 Mar 2016 19:01:31 GMT

Try like this

eval myField=replace(replace(src_domain,"\(\d+\)","."),"\.(.*)\.","\1")

Option 2

eval myField=substr(replace(src_domain,"(\w*)(\(\d+\))",".\1"),3)

Re: Regex - DNS formatting

tmarlette — Tue, 15 Mar 2016 20:19:26 GMT

the first one worked well. Thank you sir!