Splunk Search

Create a filed from lookup data

raghu0463
Explorer

Hi,

I would like to extract a field from lookup data, can i use below search for extraction

| inputlookup dataframedata.csv |regex "\s(?\A\w{1,2}+).gmail.com"

i'm trying to extract only xxxxx as server from the below field

Server_domain
xxxxxxxxxxxx.gmail.com

Tags (1)
0 Karma

raghu0463
Explorer

Examples for server_domain

dcxnaikg102.gmail.com
aedpmna002.gmail.com
xhnaskkjsyh561.gmail.com

0 Karma

mayurr98
Super Champion

what do you want to extract from all these server_domains?

0 Karma

mayurr98
Super Champion

try this :

| inputlookup dataframedata.csv |rex field=Server_domain "(?<server>[^\.]+)\.gmail\.com"

let me know if this helps!

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...