Splunk Search

Regex help

ytanaka
Engager

Hi,

I am new to splunk and regex, sorry for poor knowledge.

I am trying to extract hostname from
/var/log/syslog/2013/11/14/hostname_messages.log
So far I came up with [a-zA-Z]*([^]+).log$ but this result has _messages.log.
How Can I get rid of this part?

Tags (1)
0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee
.+/(?<hostname>.+?)\_

dmaislin_splunk
Splunk Employee
Splunk Employee

No problem. Please check the checkmark next to this post to accept the answer. Thanks!

0 Karma

ytanaka
Engager

This works like a charm!!
So this is using variable.
Thanks a lot!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

This should work for you. This takes anything between last "/" and "_".

".*/(?<host>[^_]+)"

gmor
Explorer

How about:

/([a-zA-Z0-9]+)_messages\.log

Assuming that 'hostname' only contains alpha-numeric characters.

Or, if your 'hostname' doesn't include underscores:

/([^_/]+)_messages\.log

You need to 'escape' the period character, as it has a special meaning in regex.

gmor
Explorer

Are you trying to extract the hostname as part of an input, in inputs.conf or are you trying the use the 'rex' command in the Search App?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...