All Apps and Add-ons

Using rex to remove data from a field where only some of the events contain the data?

nakiamatthews
Explorer

This was hard to describe in a title!

The host field for some indexed events includes the full FQDN, while on others only the hostname populates the host field. Examples:

 

host=server1.acme.com
host=server2
host=server3.local

 

I want to remove the FDQN portion, leaving only the hostname, like so:

 

host=server1
host=server2
host=server3

 

I am able to do this with the following:

 

rex field=host "(?<hostname>\w+)\."  

 

 

However, this only returns data for the host fields that contain a period (".") - any host fields that contain only the host name are not returned. Using the sample data from above, the following search:

index="myindex" |  rex field=host "(?<hostname>\w+)\." | table hostname

returns the following results:

server1
server3

 

How can I strip the FQDN data from the host field only for the fields for which that is applicable?

Labels (1)
Tags (2)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

try

|rex field=host "(?<hostname>[^\.]+)"

or

|rex field=host "(?<hostname1>\w+)\.?"

 

test

| makeresults |eval host="server1.acme.com server2 server3.local"|makemv host|mvexpand host
|rex field=host "(?<hostname>[^\.]+)"
|rex field=host "(?<hostname1>\w+)\.?"

View solution in original post

nickhills
Ultra Champion

An alternative approach is to run your original (or one from @renjith_nair ) regex, and then coalesce that value with "host".
In that way, you can be sure of always getting one value in your final field, even if the regex fails because you have hosts with unusual names.

 

index="myindex" | rex field=host "(?<hostname>\w+)\." | eval hostname=coalesce(hostname, host)|table hostname

 

 

If my comment helps, please give it a thumbs up!

renjith_nair
SplunkTrust
SplunkTrust

try

|rex field=host "(?<hostname>[^\.]+)"

or

|rex field=host "(?<hostname1>\w+)\.?"

 

test

| makeresults |eval host="server1.acme.com server2 server3.local"|makemv host|mvexpand host
|rex field=host "(?<hostname>[^\.]+)"
|rex field=host "(?<hostname1>\w+)\.?"

View solution in original post

nakiamatthews
Explorer

Thanks! The following option worked without having to combine any fields.

|rex field=host "(?<hostname>[^\.]+)"

 

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!