Archive

Need help rewriting DNS log lines

Champion

I have DNS log lines that look like the following:

(4)mail(6)google(3)com(0)
(7)twitter(3)com(0)
(12)spreadsheets(1)l(6)google(3)com(0)

How would I configure rewriting so that Splunk will display them in a more appealing format?

mail.google.com
twitter.com
spreadsheets.l.google.com
Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Can you use rex's sed mode? This may be a little too indiscriminate, but:

blah | rex mode=sed "s/\(\d\)/\./g"

View solution in original post

Champion
props.conf

[dns]
SEDCMD-dns = s/\(\d\)/\./g s/\(\d\d\)/\./g

* Splunk didn't seem to like \d? so I used \d\d for the cases where we have 2 digits: (12)
0 Karma

Champion

Ah ok, thanks for that. I can streamline that REGEX now 🙂

0 Karma

Splunk Employee
Splunk Employee

You need \d+, not \d?. \d? means zero or one digit. If there are never more than two, you can use \d{1,2}

0 Karma

SplunkTrust
SplunkTrust

Can you use rex's sed mode? This may be a little too indiscriminate, but:

blah | rex mode=sed "s/\(\d\)/\./g"

View solution in original post

Champion

Thank you! It seems you don't need the escape for '.' for some reason -- Ultimately, I will use sedcmd to do this.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!