All Apps and Add-ons

Using rex to remove data from a field where only some of the events contain the data?

nakiamatthews
Explorer

This was hard to describe in a title!

The host field for some indexed events includes the full FQDN, while on others only the hostname populates the host field. Examples:

 

host=server1.acme.com
host=server2
host=server3.local

 

I want to remove the FDQN portion, leaving only the hostname, like so:

 

host=server1
host=server2
host=server3

 

I am able to do this with the following:

 

rex field=host "(?<hostname>\w+)\."  

 

 

However, this only returns data for the host fields that contain a period (".") - any host fields that contain only the host name are not returned. Using the sample data from above, the following search:

index="myindex" |  rex field=host "(?<hostname>\w+)\." | table hostname

returns the following results:

server1
server3

 

How can I strip the FQDN data from the host field only for the fields for which that is applicable?

Labels (1)
Tags (2)
0 Karma
1 Solution

renjith_nair
Legend

try

|rex field=host "(?<hostname>[^\.]+)"

or

|rex field=host "(?<hostname1>\w+)\.?"

 

test

| makeresults |eval host="server1.acme.com server2 server3.local"|makemv host|mvexpand host
|rex field=host "(?<hostname>[^\.]+)"
|rex field=host "(?<hostname1>\w+)\.?"
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

nickhills
Ultra Champion

An alternative approach is to run your original (or one from @renjith_nair ) regex, and then coalesce that value with "host".
In that way, you can be sure of always getting one value in your final field, even if the regex fails because you have hosts with unusual names.

 

index="myindex" | rex field=host "(?<hostname>\w+)\." | eval hostname=coalesce(hostname, host)|table hostname

 

 

If my comment helps, please give it a thumbs up!

renjith_nair
Legend

try

|rex field=host "(?<hostname>[^\.]+)"

or

|rex field=host "(?<hostname1>\w+)\.?"

 

test

| makeresults |eval host="server1.acme.com server2 server3.local"|makemv host|mvexpand host
|rex field=host "(?<hostname>[^\.]+)"
|rex field=host "(?<hostname1>\w+)\.?"
---
What goes around comes around. If it helps, hit it with Karma 🙂

nakiamatthews
Explorer

Thanks! The following option worked without having to combine any fields.

|rex field=host "(?<hostname>[^\.]+)"

 

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...