https://community.splunk.com/t5/Splunk-Search/Extracting-selected-hosts-with-regex-Regex-hosts-with-exceptions/m-p/42279#M9866 <P>Hi Splunkers,</P> <P>I am trying to extract the hosts via regex.</P> <PRE><CODE>host="*" | regex host="([a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,6}" | dedup host | table host | sort -host </CODE></PRE> <P>The problem is that some hosts have a name and some of them come with the full domain name.</P> <P>For example:<BR /> <PRE><CODE>host<BR /> xd-test-app05.abc-xz.com<BR /> xd-test-app04.abc-xz.com<BR /> xd-test-app03<BR /> xd-test-app03.abc-xz.com<BR /> xd-test-app02<BR /> xd-test-app02.abc-xz.com<BR /> xd-test-app01.abc-xz.com<BR /> xd-shared-db01.abc-xz.com<BR /> xd-qa-app08.abc-xz.com<BR /> </CODE></PRE></P> <P>Is there a way to add an exception to my regex?</P> <P>Thanks in advance for your help.</P> <P>regards<BR /> Mike</P> Mon, 25 Feb 2013 15:57:43 GMT lemikg 2013-02-25T15:57:43Z https://community.splunk.com/t5/Splunk-Search/Extracting-selected-hosts-with-regex-Regex-hosts-with-exceptions/m-p/42279#M9866 <P>Hi Splunkers,</P> <P>I am trying to extract the hosts via regex.</P> <PRE><CODE>host="*" | regex host="([a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,6}" | dedup host | table host | sort -host </CODE></PRE> <P>The problem is that some hosts have a name and some of them come with the full domain name.</P> <P>For example:<BR /> <PRE><CODE>host<BR /> xd-test-app05.abc-xz.com<BR /> xd-test-app04.abc-xz.com<BR /> xd-test-app03<BR /> xd-test-app03.abc-xz.com<BR /> xd-test-app02<BR /> xd-test-app02.abc-xz.com<BR /> xd-test-app01.abc-xz.com<BR /> xd-shared-db01.abc-xz.com<BR /> xd-qa-app08.abc-xz.com<BR /> </CODE></PRE></P> <P>Is there a way to add an exception to my regex?</P> <P>Thanks in advance for your help.</P> <P>regards<BR /> Mike</P> Mon, 25 Feb 2013 15:57:43 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-selected-hosts-with-regex-Regex-hosts-with-exceptions/m-p/42279#M9866 lemikg 2013-02-25T15:57:43Z https://community.splunk.com/t5/Splunk-Search/Extracting-selected-hosts-with-regex-Regex-hosts-with-exceptions/m-p/42280#M9867 <P>What does the source data look like, are they all fqdn's? Why do you have . in your capture group, as that should match any character.</P> Mon, 25 Feb 2013 17:26:19 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-selected-hosts-with-regex-Regex-hosts-with-exceptions/m-p/42280#M9867 mikelanghorst 2013-02-25T17:26:19Z https://community.splunk.com/t5/Splunk-Search/Extracting-selected-hosts-with-regex-Regex-hosts-with-exceptions/m-p/42281#M9868 <P>Hi, I can't answer the question regarding The "." in my capture group since I just copied that from an example. St this point I can't provide Any sourcedata since i am not in The office any more. But The source is nothing special Art all.</P> Mon, 25 Feb 2013 17:38:42 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-selected-hosts-with-regex-Regex-hosts-with-exceptions/m-p/42281#M9868 lemikg 2013-02-25T17:38:42Z https://community.splunk.com/t5/Splunk-Search/Extracting-selected-hosts-with-regex-Regex-hosts-with-exceptions/m-p/42282#M9869 <P>A lot of the expression was lost in the formatting, now (amongst other things) the period is escaped properly.</P> Mon, 25 Feb 2013 17:49:44 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-selected-hosts-with-regex-Regex-hosts-with-exceptions/m-p/42282#M9869 martin_mueller 2013-02-25T17:49:44Z https://community.splunk.com/t5/Splunk-Search/Extracting-selected-hosts-with-regex-Regex-hosts-with-exceptions/m-p/42283#M9870 <P>If they're all from the same domain</P> <PRE><CODE>host="*" | rex field=host "^(?&lt;host&gt;[^.]+)" | dedup host | table host | sort -host </CODE></PRE> Mon, 25 Feb 2013 22:33:57 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-selected-hosts-with-regex-Regex-hosts-with-exceptions/m-p/42283#M9870 jonuwz 2013-02-25T22:33:57Z