Splunk Search

How do I write the regex to extract a DNS domain field from my sample data?

Path Finder

Hi :

I need help extracting the domain IP address for the DNS logs. The automatic field extractor does not work in my case.

Here is the sample raw file:

11/8/2015 5:17:24 PM 1A5C PACKET  000000B9E66AE560 UDP Rcv 10.230.138.230  9bf2   Q [1001   D   NOERROR] AAAA   access-qa.truvenhealth.com

I need splunk to extract access-qa.truvenhealth.com as a field. I am unable to do so because the regex pattern doesn't fit it well.

0 Karma
1 Solution

Esteemed Legend

If it is always the last thing, then like this:

... | rex "(?<dns_domain>[\S]+)$"

View solution in original post

Explorer

Like this:

(?\w+)\.(?.*)
0 Karma

Explorer

Since the original post did not keep all the information I've updated this to reflect the correct statements and added one just in case you have additional characters in the name.

| rex field="dnsName" "(?<name_Host_Dns>\w+)\.(?<name_Domain_Dns>.*)"

| rex field="dnsName" "(?<name_Host_Dns>[a-zA-Z0-9-_]+)\.(?<name_Domain_Dns>.*)"

Optionally you can do this

| rex field="dnsname" "(?<dnsdomain>\..*)"
| eval dnshostname = replace('dnsname',dnsdomain',"")
| eval dnsdomain = replace(dnsdomain,"^.{1}","") 
0 Karma

Esteemed Legend

I added code-markdown. Go in and keep the leading spaces and fix it the way that it should look and it will stick.

0 Karma

Explorer

Thanks for the assist.

0 Karma

Esteemed Legend
0 Karma

Esteemed Legend

This is interesting; I understand that both answers work and are correct but it is not supposed to be possible to Accept more than 1 answer. @OMohi, how were you able to do this?

0 Karma

Esteemed Legend

If it is always the last thing, then like this:

... | rex "(?<dns_domain>[\S]+)$"

View solution in original post

Splunk Employee
Splunk Employee

How about keying the regex off the closing bracket? Try:

(Base search)| rex "\]\s+\w+\s+(?<dns_domain>.*)"
0 Karma

Builder

Why complicate it? Just anchor it to the end like @woodcock suggested.

0 Karma