Field Extraction - Hostname with inconsistent

[jpsheridan]

I'm trying to do a field extraction for a hostname field that has some inconsistency with the format.

There are two types of formats for the hostname field and they can be in upper or lower, i need them in lower.

DOMAIN\hostname or hostname.xxxx.xx.xxx

Previously, I was replacing what I didn't want in that field , lowering that eval in order to join to a lookup table. What I'm trying to do now is a field extraction from that hostname field check for both formats and then removes DOMAIN\ or the .xxxxx.xx.xxx fqdn format from the end.

My REX commands that I'm using:

| rex field=hostname "DOMAIN\\\(?P<ComputerName>.*)"

|rex field=hostname "^(?<ComputerName>[^\.]+)"

Any help would be appreciated!

[vnravikumar]

Hi

Try this

| makeresults 
| eval hostname = "DOMAIN\host1,host2.xxxx.xx.xxxx" 
| makemv delim="," hostname 
| mvexpand hostname 
| rex field=hostname "(DOMAIN\\\){0,1}(?P<host>[^.]+)"

[richgalloway]

What results are you getting from your current search?  What results do you want?

It would help to see some sample data.

[jpsheridan]

I will get a mix of hostnames in these two formats:

DOMAIN\hostname

hostname.xxxxx.xx.xxxx

DOMAIN and the x's are just from their fqdn. Some are upper and some are lower and the source is coming from a 3rd party system. I just want to pull the hostname in lower case for a field extraction.

[ITWhisperer]

What is wrong with the two rex you already have (apart from perhaps too many backslashes?)?