Splunk Search

Extract host name from FQDN while searching.

Ravan
Path Finder

Hi,

How can we extract hostname from FQDN at runtime(Need to include with in the query)

Ex: myhost.domain.com (OR) myhost.subdomain.maindomain.com

we need only myhost here ...

Tags (2)
0 Karma

kristian_kolb
Ultra Champion

Hi there,

I am assuming that you want to extract the hostname into a new field (since 'host' is a field that is always set). Just getting the host part of a FQDN is pretty straightforward (assuming that your field is called "FQDN");

... | rex field=FQDN "(?<host_name>[^.]+)\." | table host_name

and you can start using the new field straight away, as indicated above.

hope this helps,

Kristian

Ravan
Path Finder

in this case i have three fields (host,ip,os) , and we need to set the values in same "host"field.

Actual data :
host ip os
mywi2.R2.devel.in.com win
pctx1.R2.devel.in.com win
masymf.R1.prod.in.com win
swgdas.R2.devel.in.com win
dass.R2.devel.in.com win
swssch.R2.devel.in.com win

0 Karma

lguinn2
Legend

In order to help, we need to know more about the data - an example of the actual data (with identifying information anonymized) would be helpful. Also, are you talking about setting the value of the host field, or do you want to create a different field?

I assume that different events in the same input stream could have different hostnames.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...