Splunk Search

RegEx Help Needed

danfinan
Explorer

Hi guys,

I'm a complete newbie when it comes to RegEx, but I was wondering if someone could please advise on how I could extract the name of the device from the following string?

"hostname"="iPhone"

The syslog I am using has every data point in the same format, I would like to make sure that Splunk correctly identifies the hostname each time. The built-in field extraction tool could recognise the term 'iPhone' but not something like 'DESKTOP-8HGF56' for example. I need it to be 100% every time so perhaps a regex term could let anything between "hostname"="xxxx" be extracted?

Any advice would be greatly appreciated, thank you!

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi danfinan,
try this

| rex "\"hostname\"\=\"(?<device_name>[^\"]*)\""

you can test it at https://regex101.com/r/kQZJQe/1

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi danfinan,
try this

| rex "\"hostname\"\=\"(?<device_name>[^\"]*)\""

you can test it at https://regex101.com/r/kQZJQe/1

Bye.
Giuseppe

danfinan
Explorer

Giuseppe, you wonderful human - that worked perfectly, exactly what I was looking for. Thank you very much for your help, greatly appreciated!

0 Karma

jpolvino
Builder

Giuseppe uses a noteworthy tactic: matching on characters that are NOT something. In this case, matching on characters that are not double quotes. You may find that this is much more reliable that listing out the legal characters or character classes. I use this a lot and it has saved time by making the matching much more reliable.

0 Karma

manuelostertag
Path Finder

Indeed, this regex solution is the better one 🙂

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi danfinan,
if this answer satisfies your need, please accept and/or upvote it.
Bye and see next time.
Giuseppe

0 Karma

manuelostertag
Path Finder

Hi,

to "extract" the device name, please try this regex:

"\w.+"="(?P<device_name>.+)"

The value will be stored in device_name.

Here you can test the regex https://regex101.com/r/LNP0Ia/1

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...