Hello
I have a field called hostName which contains hosts:
host1\user1
host1\user2
host2\user2
host3\user3
And I want to basically do a count of the number of times each host appears:
so:
Host1 = 2
Host2 = 1
Host3 = 1
So I want to cut the data after the backslash (\) and display the host part of the data as a count.
I worked out the regex for this is ".+?\\" on Regex 101 but I am not able to figure it out with the rex field commands
Thank you!
Hi @Yy4pb,
please try something like this:
| rex field=your_field "^(?<your_host>[^\\]+)"
Ciao.
Giuseppe
Hi @Yy4pb,
please try something like this:
| rex field=your_field "^(?<your_host>[^\\]+)"
Ciao.
Giuseppe
EDIT: I had to add more backslashes to the Regex
| rex field=your_field "^(?<your_host>[^\\\\]+)"
Thanks!!
_________________
However when I run your command I get an error
Error in 'rex' command: Encountered the following error while compiling the regex '^(?<your_host>[^\]+)': Regex: missing terminating ] for character class.
Hiu @Yy4pb,
you used too many backslashes, the last of tem is considered by Splunk as an escape of ], so the condition in the regex isn't closed.
Try using [^\\] or [^\\\].
Ciao.
Giuseppe