Splunk Search

Need help with Rex Function

Stephen11
Explorer

I got a variable called _host_name which = usscic-secfio102.na.xxx.com.  I need to derive a variable called host_short which will have the value of usscic-secfio102   -- I use Ruby Regular expression editor to figure out expression to get string i need -- it's    ^\w+.\w+     How do I integrate in querty using rex?

 

index=cisco sourcetype=cisco_asa AND vendor_action=permitted AND host=158.11.333.444 | eval service=transport."/".dest_port| lookup dnslookup ip as host output host as host_name| rex????? | table host_short

Labels (1)
0 Karma

Stephen11
Explorer

thanks ... that was easy

 

0 Karma

to4kawa
Ultra Champion

rex field=called _host_name "(?<short_host>[^\.]+)"
how about this?

Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...