How to extract a new field that contains the domain name for machines on the network?

[ngb]

Hi,

I'm importing data from Nmap and would like to get the full domain name for the machines on the network.
The output looks like that:

<elem key="date">2016-11-27T13:01:38+01:00</elem>
<elem key="fqdn">XXXXXXXXX.mydomain.domain.com</elem>
<elem key="domain_dns">mydomain.domain.com</elem>
<elem key="forest_dns">domain.com</elem>
<elem key="workgroup">XXX\x00</elem>

Is it possible to extract a new field which contains only the text between <elem key="fqdn"> and </elem>.

On Linux I am able to do this with a script, but I am currently testing it on Windows.

Thanks!

[gokadroid · Accepted solution]

Please try this as the one which will extract the domain name between <elem key="fqdn">XXXXXXXXX.mydomain.domain.com</elem> in a field called fullDomainName

your query to return you the event containing the data
| rex field=_raw "\<elem\skey=\"fqdn\"\>(?<fullDomainName>[^\<]+)<\/elem\>"
| table fullDomainName

See extraction here

[ngb]

Thank you!

[skoelpin]

Hi @ngb, welcome to Splunk Answers!

Yes, here's your regular expression to do that.. The field will be called "Domain".. You can easily change the field name by editing the value between < ... > .. Also to clarify, the ... | is your base search

... | rex elem\skey\=\"(?P<Domain>\w+)

[skoelpin]

@ngb, did this help solve your problem? If so can you accept the answer and close it?