Hi,
I'm importing data from Nmap and would like to get the full domain name for the machines on the network.
The output looks like that:
<elem key="date">2016-11-27T13:01:38+01:00</elem>
<elem key="fqdn">XXXXXXXXX.mydomain.domain.com</elem>
<elem key="domain_dns">mydomain.domain.com</elem>
<elem key="forest_dns">domain.com</elem>
<elem key="workgroup">XXX\x00</elem>
Is it possible to extract a new field which contains only the text between <elem key="fqdn">
and </elem>
.
On Linux I am able to do this with a script, but I am currently testing it on Windows.
Thanks!
Please try this as the one which will extract the domain name between <elem key="fqdn">XXXXXXXXX.mydomain.domain.com</elem>
in a field called fullDomainName
your query to return you the event containing the data
| rex field=_raw "\<elem\skey=\"fqdn\"\>(?<fullDomainName>[^\<]+)<\/elem\>"
| table fullDomainName
Please try this as the one which will extract the domain name between <elem key="fqdn">XXXXXXXXX.mydomain.domain.com</elem>
in a field called fullDomainName
your query to return you the event containing the data
| rex field=_raw "\<elem\skey=\"fqdn\"\>(?<fullDomainName>[^\<]+)<\/elem\>"
| table fullDomainName
Thank you!
Hi @ngb, welcome to Splunk Answers!
Yes, here's your regular expression to do that.. The field will be called "Domain".. You can easily change the field name by editing the value between < ... >
.. Also to clarify, the ... |
is your base search
... | rex elem\skey\=\"(?P<Domain>\w+)
@ngb, did this help solve your problem? If so can you accept the answer and close it?