Getting Data In

Regex to extract for fqdn

jaydee12
Engager

Hi - Was looking for some assistance in extracting the FQDNs from the paths below:

/var/log/remote/ldap.inftech.net/2021-08-03/auth.log
/var/log/remote/web-proxy-01.int.inftech.net/2021-08-03/proxy.log
/var/log/remote/ns01.inftech.net/2021-08-03/named.log

Regex isn't my strongest area, and one of the domains has an additional level, which makes it that much harder for me.

Labels (2)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @jaydee12 

try this,

 

<your_search_goes_here>
| rex field=<your_field_name> "var\/log\/remote\/(?<fqdn>.+?)\/"

 

View solution in original post

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @jaydee12 

try this,

 

<your_search_goes_here>
| rex field=<your_field_name> "var\/log\/remote\/(?<fqdn>.+?)\/"

 

0 Karma

jaydee12
Engager

HI @venkatasri  - Thanks for the quick reply.  No, I wasn't able to get that to work.  Basically what I am trying to do is extract the FQDN hostname so that I can use it in my input.conf file.

Similar to what this guy is doing:

https://community.splunk.com/t5/Getting-Data-In/Help-extracting-hostname-with-host-regex-from-path/m...

0 Karma

venkatasri
SplunkTrust
SplunkTrust

@jaydee12  Rex looks fine see below. commands before | rex for testing you shall replace with your own search.

venkatasri_0-1628041378654.png

 

0 Karma

jaydee12
Engager

Yes, you are correct...that did work,  Greatly appreciate your help!

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...