Need help rewriting DNS log lines

[the_wolverine]

I have DNS log lines that look like the following:

(4)mail(6)google(3)com(0)
(7)twitter(3)com(0)
(12)spreadsheets(1)l(6)google(3)com(0)

How would I configure rewriting so that Splunk will display them in a more appealing format?

mail.google.com
twitter.com
spreadsheets.l.google.com

[the_wolverine]

props.conf

[dns]
SEDCMD-dns = s/\(\d\)/\./g s/\(\d\d\)/\./g

* Splunk didn't seem to like \d? so I used \d\d for the cases where we have 2 digits: (12)

[the_wolverine]

Ah ok, thanks for that. I can streamline that REGEX now 🙂

[gkanapathy]

You need \d+, not \d?. \d? means zero or one digit. If there are never more than two, you can use \d{1,2}

[dwaddle · Accepted solution]

Can you use rex's sed mode? This may be a little too indiscriminate, but:

blah | rex mode=sed "s/\(\d\)/\./g"

[the_wolverine]

Thank you! It seems you don't need the escape for '.' for some reason -- Ultimately, I will use sedcmd to do this.