Splunk Search

Regex - DNS formatting

tmarlette
Motivator

I am attempting to format my DNS data to a standard format. I'm thinking I can use REGEX / SED for the this formatting.

This is my current field value:

(19)espnfivethirtyeight(5)files(9)wordpress(3)com(0)

This is the value that I would like to see:

espnfivethirtyeight.files.wordpress.com

I've used eval to replace the pattern eval myField=replace(src_domain,"\(\d+\)",".") and that replaces the values to the following, and the first and last '.' are adjusting my search results

.espnfivethirtyeight.files.wordpress.com.

Is there anything I can use in order to make the desired adjustment?

Thank you so much!!

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

eval myField=replace(replace(src_domain,"\(\d+\)","."),"\.(.*)\.","\1")

Option 2

eval myField=substr(replace(src_domain,"(\w*)(\(\d+\))",".\1"),3)

View solution in original post

somesoni2
Revered Legend

Try like this

eval myField=replace(replace(src_domain,"\(\d+\)","."),"\.(.*)\.","\1")

Option 2

eval myField=substr(replace(src_domain,"(\w*)(\(\d+\))",".\1"),3)

tmarlette
Motivator

the first one worked well. Thank you sir!

Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...