Getting Data In

host_regex syntax for SMB share?

the_wolverine
Champion

I need a syntax example for host_regex to pull the hostname out of a share like the following:

[monitor://\\norcal_server\c$\Windows\System32\LogFiles]
0 Karma

kristian_kolb
Ultra Champion

Since the messageboard seems to be rather moody today, I'm having trouble writing HTML-specific characters at the moment, like < or >, so here goes.

\[monitor\:\/+\\+(?< HOST >[^\\]+)\\

You'd have to remove the spaces surrounding HOST..

or perhaps, even simpler

\\{2}(?< host >[^\\]+)\\

Hope this helps,

Kristian

0 Karma
Get Updates on the Splunk Community!

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...

Hunt Smarter, Not Harder: Discover New SPL “Recipes” in Our Threat Hunting Webinar

Are you ready to take your threat hunting skills to the next level? As Splunk community members, you know the ...