Splunk Search

How to replace a specific character?

quangtran
Explorer

Hi,

I have the below output :

1/16/2023 7:51:43 AM 1EE8 PACKET 000001D9C25E6180 UDP Rcv 10.8.64.132 646b Q [0001 D NOERROR] A (6)framer(3)com(0)
UDP question info at 000001D9C25E6180
Socket = 940
Remote addr 10.8.64.132, port 55646
Time Query=9030678, Queued=0, Expire=0
Buf length = 0x0fa0 (4000)
Msg length = 0x001c (28)
Message:
XID 0x646b
Flags 0x0100

The desired output

name=framer.com

IP=10.8.64.132

I using regex: 

sourcetype=DNSlog |rex field=_raw "NOERROR]\W+(?P<name>.*)\sUDP \S.*\s Socket.*\s Remote addr\W+(?P<IP>.*)," | rex mode=sed field=name "s/[\d;()]+//g" |stats count by name IP

 

My below code isn't working, can you please help me?

Labels (1)
0 Karma

yeahnah
Motivator

Hi @quangtran 

The first rex extraction you're using will not match newlines (\n) or carriage returns (\r) so does not work.

Based on your example inputs, you could try something like this


sourcetype=DNSlog
| rex "\].+?\)(?P<subdomain>[^(]+).+?\)(?P<topleveldomain>[^(]+)(?:.+?[\r\n]){3}Remote addr (?P<IP>[^,]+)"
| eval name=subdomain . "." . topleveldomain
| stats count BY name IP


 I web sight like https://regex101.com/ is a good place to test and modify your regular expressions out to get them working.

Hope this helps

quangtran
Explorer

thanks you, I think my regex is correct, but i don't replace a number and specific character with space

quangtran_0-1673841705036.png

 

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...