How to extract host field values with regex?

[Raghav2384]

Hello Experts,

I am trying to extract hosts from the following in 2 ways
15 21:26:18 cmflouxy005.sample.xy.com storage_config_info[15580]: GETIT_Store_Reflection_data|INQ|cmflouxy005|/dev/rdsk/A3x5000097408315E90d63s2|000292603159|2606|R1|9437760
Approach # 1: i tried (^.*?\d{2}:d{2}:d{2})\s(?\S+)" this gives me cmflouxy005.sample.xy.com but i need 'cmflouxy005' only.

Approach # 2: Can you also help me how to extract the host value that's between the pipes on second line? by knowing both the ways, i am hoping to get a good understanding of regex and extractions involving special chars.

Another roadblock: sometimes i have IP addresses in place of FQDN in the logs.
Thanks in advance,
Raghav

[esix_splunk]

For capturing IP, \d+ will work fine. This is probably a better example in terms of regex and not being greedy-

^\d+\s\d{2}:\d{2}:\d{2}\s(?<host>(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})|\w+)

And is that log actually two lines, or is it one single line event? In the later case, the second regex needs to be changed.. The below will look for the second occurrence of '|' from the beginning of the line and capture the word after that.

^(?:[^|]*\|){2}(?<hostname>\w[^|]*)

Cheers.

[Raghav2384]

using d{1,3} instead of d+did the magic. Thank you

[musskopf · Accepted solution]

You could use like this, didn't test 100% but it should select the IP or the first part of the FQDN.

^\d+\s\d{2}:\d{2}:\d{2}\s(?<hostname>((\d+\.\d+\.\d+\.\d+|\w+)))

for the second line, with the Pipes, you can use:

^\w+\|\w+\|(?<hostname>(\d+\.\d+\.\d+\.\d+|\w+))

If you have the both lines on the same sourcetype, you probably want to give different names to the extracted fields.

Btw, this is a good site to test RegExps:
http://regex101.com/#pcre

[esix_splunk]

d+ is a greedy search in regex. So it will return 0 to infinite numbers. Ip addresses do have constraints d{1,3}. So I would image the pattern matching in your data without a proper regex wouldnt identify it properly.

[Raghav2384]

it worked after i changed \d+ to \d{1,3}. For some reason the field doesn't appear in interesting fields area if i use \d+. Do you know the reason?

Thank you for the link and appreciate you help.