Splunk Search

Field Extraction - Hostname with inconsistent

jpsheridan
Engager

I'm trying to do a field extraction for a hostname field that has some inconsistency with the format.

There are two types of formats for the hostname field and they can be in upper or lower, i need them in lower.

DOMAIN\hostname or hostname.xxxx.xx.xxx

Previously, I was replacing what I didn't want in that field , lowering that eval in order to join to a lookup table. What I'm trying to do now is a field extraction from that hostname field check for both formats and then removes DOMAIN\ or the .xxxxx.xx.xxx fqdn format from the end.


My REX commands that I'm using:

| rex field=hostname "DOMAIN\\\(?P<ComputerName>.*)"

|rex field=hostname "^(?<ComputerName>[^\.]+)"

Any help would be appreciated!

Labels (2)

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval hostname = "DOMAIN\host1,host2.xxxx.xx.xxxx" 
| makemv delim="," hostname 
| mvexpand hostname 
| rex field=hostname "(DOMAIN\\\){0,1}(?P<host>[^.]+)"

richgalloway
SplunkTrust
SplunkTrust

What results are you getting from your current search?  What results do you want?

It would help to see some sample data.

---
If this reply helps you, Karma would be appreciated.

jpsheridan
Engager

I will get a mix of hostnames in these two formats:

DOMAIN\hostname

hostname.xxxxx.xx.xxxx

DOMAIN and the x's are just from their fqdn. Some are upper and some are lower and the source is coming from a 3rd party system. I just want to pull the hostname in lower case for a field extraction.

ITWhisperer
SplunkTrust
SplunkTrust

What is wrong with the two rex you already have (apart from perhaps too many backslashes?)?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...