Getting Data In

How to clean up dnslogs and replacing and trimming characters?

secphilomath1
Explorer

We have some MS dns logs we want to ingest and we want to clean up some of the text before processing.

 

Essentially the fielddata is coming in as (10)somedomain(3)diy(8)whatever(3)com(0) and we want to only show as somedomain.diy.whatever.com

 

I have the first part I think, and using the search as a test of course...

 

| rex field=query mode=sed "s/\(.*?\)/./g"

Which leaves me with .somedomain.diy.whatever.com. I can't seem to find a way to get rid of the leading and trailing .'s 

Is there away to do it in all one line?  Bear with me here, this is new territory for me.

 

Thanks for your help

Labels (2)
Tags (1)
0 Karma

yeahnah
Motivator

Hi @secphilomath1 

Here's a method you could try

| makeresults
| eval query="(10)somedomain(3)diy(8)whatever(3)com(0)"
      ,query=replace(query, "^\(\d+\)|\(\d+\)$", "")
| rex field=query mode=sed "s/\(.*?\)/./g"

 Hope it helps

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...