Getting Data In

regex

pavanbmishra
Path Finder

what should the best regex to catch it up these 3 diff fields 

 

-ec-1
-ec-01
-ec01

Labels (1)
Tags (1)
0 Karma

pavanbmishra
Path Finder

We have host field ending with these strings ( -ec-1/-ec-01/-ec01)have to be captured through regex.

abc-ec-1
xyz-ec-01
pqr-ec01

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pavanbmishra,

please try this

\w+-(?<your_field>.*)

that you can test at https://regex101.com/r/ujVKV6/1

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pavanbmishra,

could you share a sample of your logs to be more sure?

Anyway, if these are the strings to extract as field, you could use:

| rex "(?<your-field>ex[^ ]+)"

But, please share your logs.

ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...