How can I extract a value from a field that have many content

[lllidan]

I have a field named "Message", the content as below:

*Active Directory Domain Services could not use DNS to resolve the IP address of the source domain controller listed below. To maintain the consistency of Security groups, group policy, users and computers and their passwords, Active Directory Domain Services successfully replicated using the NetBIOS or fully qualified computer name of the source domain controller.

Invalid DNS configuration may be affecting other essential operations on member computers, domain controllers or application servers in this Active Directory Domain Services forest, including logon authentication or access to network resources.

You should immediately resolve this DNS configuration error so that this domain controller can resolve the IP address of the source domain controller using DNS.

Alternate server name:
AAABB0001
Failing DNS host name:*

I want to extract value "AAABB0001", I tried to use eval n=mvfind(Message,"\w{5}\d{4}"), but it only return a value "0".

Could you please give some better solution for me? thanks

[vnravikumar · Accepted solution]

Hi

Try this

| makeresults 
| eval message="Active Directory Domain Services could not use DNS to resolve the IP address of the source domain controller listed below. To maintain the consistency of Security groups, group policy, users and computers and their passwords, Active Directory Domain Services successfully replicated using the NetBIOS or fully qualified computer name of the source domain controller.


Invalid DNS configuration may be affecting other essential operations on member computers, domain controllers or application servers in this Active Directory Domain Services forest, including logon authentication or access to network resources.


You should immediately resolve this DNS configuration error so that this domain controller can resolve the IP address of the source domain controller using DNS.


Alternate server name:
AAABB0001
Failing DNS host name:" |rex field=message "Alternate server name:\n+(?P<servername>\w+)"