Splunk Search

How to extract a new field that contains the domain name for machines on the network?

Engager

Hi,

I'm importing data from Nmap and would like to get the full domain name for the machines on the network.
The output looks like that:

<elem key="date">2016-11-27T13:01:38+01:00</elem>
<elem key="fqdn">XXXXXXXXX.mydomain.domain.com</elem>
<elem key="domain_dns">mydomain.domain.com</elem>
<elem key="forest_dns">domain.com</elem>
<elem key="workgroup">XXX\x00</elem>

Is it possible to extract a new field which contains only the text between <elem key="fqdn"> and </elem>.

On Linux I am able to do this with a script, but I am currently testing it on Windows.

Thanks!

1 Solution

Motivator

Please try this as the one which will extract the domain name between <elem key="fqdn">XXXXXXXXX.mydomain.domain.com</elem> in a field called fullDomainName

your query to return you the event containing the data
| rex field=_raw "\<elem\skey=\"fqdn\"\>(?<fullDomainName>[^\<]+)<\/elem\>"
| table fullDomainName

See extraction here

View solution in original post

Motivator

Please try this as the one which will extract the domain name between <elem key="fqdn">XXXXXXXXX.mydomain.domain.com</elem> in a field called fullDomainName

your query to return you the event containing the data
| rex field=_raw "\<elem\skey=\"fqdn\"\>(?<fullDomainName>[^\<]+)<\/elem\>"
| table fullDomainName

See extraction here

View solution in original post

Engager

Thank you!

0 Karma

SplunkTrust
SplunkTrust

Hi @ngb, welcome to Splunk Answers!

Yes, here's your regular expression to do that.. The field will be called "Domain".. You can easily change the field name by editing the value between < ... > .. Also to clarify, the ... | is your base search

... | rex elem\skey\=\"(?P<Domain>\w+)

0 Karma

SplunkTrust
SplunkTrust

@ngb, did this help solve your problem? If so can you accept the answer and close it?

0 Karma