I have DNS log lines that look like the following:
(4)mail(6)google(3)com(0)
(7)twitter(3)com(0)
(12)spreadsheets(1)l(6)google(3)com(0)
How would I configure rewriting so that Splunk will display them in a more appealing format?
mail.google.com
twitter.com
spreadsheets.l.google.com
Can you use rex's sed mode? This may be a little too indiscriminate, but:
blah | rex mode=sed "s/\(\d\)/\./g"
props.conf
[dns]
SEDCMD-dns = s/\(\d\)/\./g s/\(\d\d\)/\./g
* Splunk didn't seem to like \d? so I used \d\d for the cases where we have 2 digits: (12)
Ah ok, thanks for that. I can streamline that REGEX now 🙂
You need \d+, not \d?. \d? means zero or one digit. If there are never more than two, you can use \d{1,2}
Can you use rex's sed mode? This may be a little too indiscriminate, but:
blah | rex mode=sed "s/\(\d\)/\./g"
Thank you! It seems you don't need the escape for '.' for some reason -- Ultimately, I will use sedcmd to do this.