Field Extraction of a hostname

[daniel333]

Should be easy enough, but not working for me. I am trying to pull a hostname of a log. I am terrible at regex and trying to get better.
^ = starts with
.* = any number of characters
_ = space?

transforms.conf

DEST_KEY = MetaData:Host
REGEX = ^(.*)_
FORMAT = host::$1

Here is format of the log:

localhost nmap 25 tcp allowed smtp

For some reason it's not extracting this hostname.

[s2_splunk]

Answered below, but from one RegEx certifiable person to another: I found this to be a great learning tool. 🙂

[Richfez]

Oh, I like that, I'll add it to the arsenal of regex101.com...

[Richfez]

If it's always the first space-delimited item in the log, then try...

REGEX=^[^\s]*

(the rest is the same). That's from the start of the string ^ search characters that aren't [^...] a space \s, and grab zero or more of those *

[s2_splunk]

I think you are missing a capturing group in there: REGEX=^([^\s]*) should do it.

[Richfez]

Oh, good catch, thanks!