How can I parse out both the Named Address and IP Address and format them into an Extracted Field?

[justdan23]

The log entry I have has:

Message=DNS query is completed for the name my.big.server.name.com, type 28, query options 1073897472 with status 0 Results ::ffff:10.2.1.20

How can I extract both the Named Address and IP Address into one Extracted Field with the value:

my.big.server.name.com (10.2.1.20)

The UI gives me an option to provide my own regex, but it clips the text:

DNS query is completed for the name (?P <dns_lookup>[^\, type]+)

[Vijeta]

@justdan23

You can use the rex commands and get final output by concatenating .

<your query>| rex field=_raw "\s+(?<domain>\w+\.\w+\.\w+\.\w+\.\w+)"| rex field=_raw "\S+:(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"| eval fname=domain+" "+ip

[justdan23]

Note: The code block in this interface adds the numbers when trying to block a data sample.

Is there a better way for me to format this?

The Preview doesn't show the numbers before I posted it.