Getting Data In

regex

pavanbmishra
Path Finder

what should the best regex to catch it up these 3 diff fields 

 

-ec-1
-ec-01
-ec01

Labels (1)
Tags (1)
0 Karma

pavanbmishra
Path Finder

We have host field ending with these strings ( -ec-1/-ec-01/-ec01)have to be captured through regex.

abc-ec-1
xyz-ec-01
pqr-ec01

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pavanbmishra,

please try this

\w+-(?<your_field>.*)

that you can test at https://regex101.com/r/ujVKV6/1

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pavanbmishra,

could you share a sample of your logs to be more sure?

Anyway, if these are the strings to extract as field, you could use:

| rex "(?<your-field>ex[^ ]+)"

But, please share your logs.

ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...