Splunk Search

How to extract a new field that contains the domain name for machines on the network?

ngb
Engager

Hi,

I'm importing data from Nmap and would like to get the full domain name for the machines on the network.
The output looks like that:

<elem key="date">2016-11-27T13:01:38+01:00</elem>
<elem key="fqdn">XXXXXXXXX.mydomain.domain.com</elem>
<elem key="domain_dns">mydomain.domain.com</elem>
<elem key="forest_dns">domain.com</elem>
<elem key="workgroup">XXX\x00</elem>

Is it possible to extract a new field which contains only the text between <elem key="fqdn"> and </elem>.

On Linux I am able to do this with a script, but I am currently testing it on Windows.

Thanks!

1 Solution

gokadroid
Motivator

Please try this as the one which will extract the domain name between <elem key="fqdn">XXXXXXXXX.mydomain.domain.com</elem> in a field called fullDomainName

your query to return you the event containing the data
| rex field=_raw "\<elem\skey=\"fqdn\"\>(?<fullDomainName>[^\<]+)<\/elem\>"
| table fullDomainName

See extraction here

View solution in original post

gokadroid
Motivator

Please try this as the one which will extract the domain name between <elem key="fqdn">XXXXXXXXX.mydomain.domain.com</elem> in a field called fullDomainName

your query to return you the event containing the data
| rex field=_raw "\<elem\skey=\"fqdn\"\>(?<fullDomainName>[^\<]+)<\/elem\>"
| table fullDomainName

See extraction here

ngb
Engager

Thank you!

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Hi @ngb, welcome to Splunk Answers!

Yes, here's your regular expression to do that.. The field will be called "Domain".. You can easily change the field name by editing the value between < ... > .. Also to clarify, the ... | is your base search

... | rex elem\skey\=\"(?P<Domain>\w+)

0 Karma

skoelpin
SplunkTrust
SplunkTrust

@ngb, did this help solve your problem? If so can you accept the answer and close it?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...