How do I write the regex to extract a DNS domain field from my sample data?

[OMohi]

Hi :

I need help extracting the domain IP address for the DNS logs. The automatic field extractor does not work in my case.

Here is the sample raw file:

11/8/2015 5:17:24 PM 1A5C PACKET  000000B9E66AE560 UDP Rcv 10.230.138.230  9bf2   Q [1001   D   NOERROR] AAAA   access-qa.truvenhealth.com

I need splunk to extract access-qa.truvenhealth.com as a field. I am unable to do so because the regex pattern doesn't fit it well.

[dkadavis]

Like this:

(?\w+)\.(?.*)

[dkadavis]

Since the original post did not keep all the information I've updated this to reflect the correct statements and added one just in case you have additional characters in the name.

| rex field="dnsName" "(?<name_Host_Dns>\w+)\.(?<name_Domain_Dns>.*)"

| rex field="dnsName" "(?<name_Host_Dns>[a-zA-Z0-9-_]+)\.(?<name_Domain_Dns>.*)"

Optionally you can do this

| rex field="dnsname" "(?<dnsdomain>\..*)"
| eval dnshostname = replace('dnsname',dnsdomain',"")
| eval dnsdomain = replace(dnsdomain,"^.{1}","") 

[woodcock]

I added code-markdown. Go in and keep the leading spaces and fix it the way that it should look and it will stick.

[dkadavis]

Thanks for the assist.

[woodcock]

Use markdown:
https://answers.splunk.com/static/markdown/help.html

[woodcock]

This is interesting; I understand that both answers work and are correct but it is not supposed to be possible to Accept more than 1 answer. @OMohi, how were you able to do this?

[woodcock · Accepted solution]

If it is always the last thing, then like this:

... | rex "(?<dns_domain>[\S]+)$"

[adauria_splunk]

How about keying the regex off the closing bracket? Try:

(Base search)| rex "\]\s+\w+\s+(?<dns_domain>.*)"

[jnudell_2]

Why complicate it? Just anchor it to the end like @woodcock suggested.