Splunk Cloud Platform

Regex not extracting host

abhi04
Communicator

Hi all, 

our regex is unable to extract host from the logs, can you pleas ehelp with the correct regex.though this regex works when checked in regex101, not sure why unable to extract


[hostextract]
REGEX = ^.*\w+\s+\d+\s+(?:\d+:){2}\d+\s+(?P<test>\w+)\s+
SOURCE_KEY = _raw
DEST_KEY = MetaData:Host
FORMAT = host::$1

 

 

e.g. logs format

 

May 1 08:35:30 10.98.6.249 May 1 08:35:30 host_abc

 

Apr 10 08:45:20 10.98.6.249 Apr 10 08:45:20 host_def

 

May 1 08:35:30 10.98.6.249 May 1 08:35:30 host_ghi

 

 

Labels (2)
0 Karma

abhi04
Communicator

The starting format of logs in regex101

 

abhi04_0-1714569822025.png

 

0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@abhi04 Hello Abhi, Please use the below regex. Snip20240501_1.png

Does my answer above solve your question? If yes, spare a moment to accept the answer and vote for it. Thanks.

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...