Splunk Search

Host_Regex not working

edwardrose
Contributor

Hello All,

I know that there are lots of questions for host_regex not working. Here is mine.

[monitor:///var/log2/gns/nac/log*]
_TCP_ROUTING = gns_core_indexers
host_regex = /log\_/gm
index = remoteaccess
sourcetype = Aruba:CPPM:Syslog

And the files in the nac directory look very similar to below

log_svr-orw-nac-01
log_svr-cop-nac-04
log_svr-hop-nac-02

So I am not to sure why the regex isn't just removing the log_ and leaving the rest as the host name.

thanks
ed

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The host_regex attribute needs a capturing group. It's not clear what you want the regex to do, but perhaps this will get you started.

HOST_REGEX = log_(.*)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The host_regex attribute needs a capturing group. It's not clear what you want the regex to do, but perhaps this will get you started.

HOST_REGEX = log_(.*)
---
If this reply helps you, Karma would be appreciated.
0 Karma

edwardrose
Contributor

Thanks that worked like a charm. I am not a very good regex person 🙂

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...