Regex help

[ytanaka]

Hi,

I am new to splunk and regex, sorry for poor knowledge.

I am trying to extract hostname from
/var/log/syslog/2013/11/14/hostname_messages.log
So far I came up with [a-zA-Z]*([^]+).log$ but this result has _messages.log.
How Can I get rid of this part?

[dmaislin_splunk]

.+/(?<hostname>.+?)\_

[dmaislin_splunk]

No problem. Please check the checkmark next to this post to accept the answer. Thanks!

[ytanaka]

This works like a charm!!
So this is using variable.
Thanks a lot!

[somesoni2]

This should work for you. This takes anything between last "/" and "_".

".*/(?<host>[^_]+)"

[gmor]

How about:

/([a-zA-Z0-9]+)_messages\.log

Assuming that 'hostname' only contains alpha-numeric characters.

Or, if your 'hostname' doesn't include underscores:

/([^_/]+)_messages\.log

You need to 'escape' the period character, as it has a special meaning in regex.

[gmor]

Are you trying to extract the hostname as part of an input, in inputs.conf or are you trying the use the 'rex' command in the Search App?