Getting Data In

extracting domain info from host

pmr
Explorer

I'm trying to extract domain info from the host field at search time and have the following props and transforms set, but it doesnt seem to work. My example hostname would be art.mozart.apac.com and trying to extract mozart.apac.com. here's my props and transforms :

props.conf

[xyz]
REPORT-extract_domain_name = domain_name_extract

transforms.conf
[domain_name_extract]

SOURCE_KEY = host
REGEX = (\.\w+\.\w+\.\w+)
FORMAT = domain_name::$1

is my configuration correct ? and any reason why this doesnt work ?

thanks
pmr

Tags (1)

ziegfried
Influencer

If you want to be able to search for this field you have to either make it an indexed field (better performance)

http://www.splunk.com/base/Documentation/latest/Data/Configureindex-timefieldextraction

props.conf

[xyz]
TRANSFORMS-extract-domain = extract-domain-name

transforms.conf

[extract-domain-name]
SOURCE_KEY = MetaData:Source
REGEX=source::\w+\.([\w\.]+)$
FORMAT = domain_name::$1
WRITE_META = true

fields.conf

[domain_name]
INDEXED = true

or tell Splunk that the event content (_raw) might not contain the field value:

fields.conf

[domain_name]
INDEXED_VALUE = false

If you want to use this field just for reporting, the it should be sufficient to just extract the field:

props.conf

[xyz]
EXTRACT-domain-name = \.(?<domain_name>[\w\.]+) in source

ziegfried
Influencer

Ah, I unintentionally wrote the examples with the source field. You just have to append "in host" instead of "in source".

0 Karma

pmr
Explorer

ok, but how will i specify to extract from the host field in your props.conf you mention for reporting ? your last props.conf entry

0 Karma

Ayn
Legend

You need to escape the dots and add a backslash before your "w" characters. A dot in regex is a special character meaning 'any character'.

Your regex should probably look something like this:

(\.\w+\.\w+\.\w+)$
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...