Splunk Search

How do I write the regex to extract a DNS domain field from my sample data?

OMohi
Path Finder

Hi :

I need help extracting the domain IP address for the DNS logs. The automatic field extractor does not work in my case.

Here is the sample raw file:

11/8/2015 5:17:24 PM 1A5C PACKET  000000B9E66AE560 UDP Rcv 10.230.138.230  9bf2   Q [1001   D   NOERROR] AAAA   access-qa.truvenhealth.com

I need splunk to extract access-qa.truvenhealth.com as a field. I am unable to do so because the regex pattern doesn't fit it well.

0 Karma
1 Solution

woodcock
Esteemed Legend

If it is always the last thing, then like this:

... | rex "(?<dns_domain>[\S]+)$"

View solution in original post

dkadavis
Explorer

Like this:

(?\w+)\.(?.*)
0 Karma

dkadavis
Explorer

Since the original post did not keep all the information I've updated this to reflect the correct statements and added one just in case you have additional characters in the name.

| rex field="dnsName" "(?<name_Host_Dns>\w+)\.(?<name_Domain_Dns>.*)"

| rex field="dnsName" "(?<name_Host_Dns>[a-zA-Z0-9-_]+)\.(?<name_Domain_Dns>.*)"

Optionally you can do this

| rex field="dnsname" "(?<dnsdomain>\..*)"
| eval dnshostname = replace('dnsname',dnsdomain',"")
| eval dnsdomain = replace(dnsdomain,"^.{1}","") 
0 Karma

woodcock
Esteemed Legend

I added code-markdown. Go in and keep the leading spaces and fix it the way that it should look and it will stick.

0 Karma

dkadavis
Explorer

Thanks for the assist.

0 Karma

woodcock
Esteemed Legend
0 Karma

woodcock
Esteemed Legend

This is interesting; I understand that both answers work and are correct but it is not supposed to be possible to Accept more than 1 answer. @OMohi, how were you able to do this?

0 Karma

woodcock
Esteemed Legend

If it is always the last thing, then like this:

... | rex "(?<dns_domain>[\S]+)$"

adauria_splunk
Splunk Employee
Splunk Employee

How about keying the regex off the closing bracket? Try:

(Base search)| rex "\]\s+\w+\s+(?<dns_domain>.*)"
0 Karma

jnudell_2
Builder

Why complicate it? Just anchor it to the end like @woodcock suggested.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...