All Apps and Add-ons

Using rex to remove data from a field where only some of the events contain the data?

nakiamatthews
Explorer

This was hard to describe in a title!

The host field for some indexed events includes the full FQDN, while on others only the hostname populates the host field. Examples:

 

host=server1.acme.com
host=server2
host=server3.local

 

I want to remove the FDQN portion, leaving only the hostname, like so:

 

host=server1
host=server2
host=server3

 

I am able to do this with the following:

 

rex field=host "(?<hostname>\w+)\."  

 

 

However, this only returns data for the host fields that contain a period (".") - any host fields that contain only the host name are not returned. Using the sample data from above, the following search:

index="myindex" |  rex field=host "(?<hostname>\w+)\." | table hostname

returns the following results:

server1
server3

 

How can I strip the FQDN data from the host field only for the fields for which that is applicable?

Labels (1)
Tags (2)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

try

|rex field=host "(?<hostname>[^\.]+)"

or

|rex field=host "(?<hostname1>\w+)\.?"

 

test

| makeresults |eval host="server1.acme.com server2 server3.local"|makemv host|mvexpand host
|rex field=host "(?<hostname>[^\.]+)"
|rex field=host "(?<hostname1>\w+)\.?"
Happy Splunking!

View solution in original post

nickhills
Ultra Champion

An alternative approach is to run your original (or one from @renjith_nair ) regex, and then coalesce that value with "host".
In that way, you can be sure of always getting one value in your final field, even if the regex fails because you have hosts with unusual names.

 

index="myindex" | rex field=host "(?<hostname>\w+)\." | eval hostname=coalesce(hostname, host)|table hostname

 

 

If my comment helps, please give it a thumbs up!

renjith_nair
SplunkTrust
SplunkTrust

try

|rex field=host "(?<hostname>[^\.]+)"

or

|rex field=host "(?<hostname1>\w+)\.?"

 

test

| makeresults |eval host="server1.acme.com server2 server3.local"|makemv host|mvexpand host
|rex field=host "(?<hostname>[^\.]+)"
|rex field=host "(?<hostname1>\w+)\.?"
Happy Splunking!

nakiamatthews
Explorer

Thanks! The following option worked without having to combine any fields.

|rex field=host "(?<hostname>[^\.]+)"

 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...