host_regex question for multiple matching fields

ianathompson — Mon, 28 Sep 2020 10:14:01 GMT

I am trying to set my host name equal to part of the file name with a regex (regular expression) and I am a regex novice.

The filename is FIRST01_USELESSWORD_SECOND01_YEAR_MONTH_DAY.log. I want the host name to be FIRST01SECOND01. I can get a simple regex to pull out both of the fields with a (FIRST\d+)\w+(SECOND\d+)_ . I even tried (FIRST\d+|SECOND\d+)_ but I still only get the FIRST\d+ as the host name.

I have a second file that is FIRST_USELESSWORD_1_YEAR_MONTH_DAY.log that I am trying to the host name to be FIRST1, but am having the same issue. I don't know if a lookback or lookahead is needed. Basically, I am just at loss because of my lack of regex experience.

Any help is appreciated. Thanks.

Re: host_regex question for multiple matching fields

dwaddle — Mon, 19 Dec 2011 15:42:00 GMT

You can't do this with the host_regex shortcut. It only groks the one capture group, and doesn't give you a good way to "filter out" USELESSWORD.

You should be able to do this in the config files though.

In props.conf:

[mysourcetype]
TRANSFORMS-host=my_awesome_host_transform

In transforms.conf:

[my_awesome_host_transform]
SOURCE_KEY = MetaData:Source
DEST_KEY = MetaData:Host
REGEX = .*/(FIRST01)_USELESSWORD_(SECOND01)_
FORMAT = host::$1$2

topic Re: host_regex question for multiple matching fields in Splunk Search

host_regex question for multiple matching fields

Re: host_regex question for multiple matching fields