Splunk Search

Create a filed from lookup data

raghu0463
Explorer

Hi,

I would like to extract a field from lookup data, can i use below search for extraction

| inputlookup dataframedata.csv |regex "\s(?\A\w{1,2}+).gmail.com"

i'm trying to extract only xxxxx as server from the below field

Server_domain
xxxxxxxxxxxx.gmail.com

Tags (1)
0 Karma

raghu0463
Explorer

Examples for server_domain

dcxnaikg102.gmail.com
aedpmna002.gmail.com
xhnaskkjsyh561.gmail.com

0 Karma

mayurr98
Super Champion

what do you want to extract from all these server_domains?

0 Karma

mayurr98
Super Champion

try this :

| inputlookup dataframedata.csv |rex field=Server_domain "(?<server>[^\.]+)\.gmail\.com"

let me know if this helps!

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...