Splunk Search

Can someone help with regex to extract new field?

pacifiquen
Explorer

Hello Team,

can anyone help me with the extraction of new field

 

input: site: mclaudelinemugasqiln.platinilemu.com:1227

 site is a field

domain is mclaudelinemugasqiln.platinilemu.com:1227

i want this output: mclaudelinemugasqiln.platinilemu.com:1227

 

Thank you

Labels (2)
Tags (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Here's an example - is this what you are after with the rex statement?

| makeresults
| eval site="site: mclaudelinemugasqiln.platinilemu.com:1227"
| rex field=site "site:\s?(?<domain>.*)"

This assumes that the site field contains that entire string, i.e. "site: xxx" where xxx is the domain you want to extract.

This creates a new field called domain.

View solution in original post

VatsalJagani
SplunkTrust
SplunkTrust

@pacifiquen - Use the below command within your search:

| rex field=input "site:\s*(?<domain>^\s+)"

 

I hope this helps!!! 

0 Karma

woodcock
Esteemed Legend

... | rename site AS domain | table domain

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Here's an example - is this what you are after with the rex statement?

| makeresults
| eval site="site: mclaudelinemugasqiln.platinilemu.com:1227"
| rex field=site "site:\s?(?<domain>.*)"

This assumes that the site field contains that entire string, i.e. "site: xxx" where xxx is the domain you want to extract.

This creates a new field called domain.

Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...