Regex refining

[Karthikeya]

Regex

Please tell me what will be the best and effective way to write regex here:

"vs_name":"v-juniper-uat.opco.sony-443",

Need to extract juniper-uat.opco.sony from every event as FQDN.

I am writing the below regex and it worked. Please tell me is this good or any suggestions you give for more reliable?

|rex "vs_name\"\:\"[^\/]\-(?<fqdn>[^\/]+)\-\d+\"\,"

[livehybrid]

Hi @Karthikeya 

Does the following work well for you? This allows v- to be optional:

|makeresults | eval _raw="\"vs_name\":\"v-juniper-uat.opco.sony-443\","
| append [|makeresults | eval _raw="\"vs_name\":\"juniper-uat.opco.sony-443\","]
| rex field=_raw "vs_name\"\s*:\s*\"(?:v-)?(?<fqdn>.+)-\d+"

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[kiran_panchavat]

@Karthikeya 

Check this

[Karthikeya]

@kiran_panchavat always v is not guaranteed before fqdn as per user

[kiran_panchavat]

@Karthikeya 

if the "v-" prefix is not guaranteed, then your regex needs to be updated

[gcusello]

Hi @Karthikeya ,

if it's runs it's correct!

anyway I'd use this:

| rex "vs_name\"\:\"\w\-(?<fqdn>[^-]+)-\d+"

 Ciao.

Giuseppe

[Karthikeya]

Hi @gcusello ,

For some reason, the provided regex is not working. Can you please re check?

[gcusello · Accepted solution]

Hi @Karthikeya ,

please try this:

| rex "vs_name\":\"\w-(?<fqdn>.+)-\d+"

that you can test at https://regex101.com/r/TDLukW/1

Ciao.

Giuseppe

[Karthikeya]

@gcusello this is working. and how to make this extraction at index time I mean while indexing this field should be extracted? Please guide me.

[gcusello]

Hi @Karthikeya ,

are you sure that you want to apply this extraction at index time?

this means a greater job for indexers and this usually depends on the volume of indexed logs for extractions, how many logs must you index daily and in the peak period?

here, you can find a comparation between the two modes and a description: https://docs.splunk.com/Documentation/Splunk/9.4.1/Indexer/Indextimeversussearchtime 

Ciao.

Giuseppe

[PickleRick]

Don't use indexed extractions! Unless you have a very good reason for it (if you don't know what reason that would be you probably don't have one). Just define a proper search-time extracted field.

[kiran_panchavat]

@Karthikeya 

Apply the below configurations for the index time field extractions. 

props.conf

transforms.conf

I have uploaded the sample events to my lab environment and applied the above configurations. The fqdn field was successfully extracted. Please refer to the screenshot below

Sample events:

{"timestamp":"2025-04-10T12:34:56Z", "vs_name":"v-juniper-uat.opco.sony-443", "status":"active"}
{"timestamp":"2025-04-10T12:35:01Z", "vs_name":"qa-nginx-dev.opco.abc-8443", "status":"active"}
{"timestamp":"2025-04-10T12:35:06Z", "vs_name":"prod-apache.opco.xyz-9443", "status":"inactive"}
{"timestamp":"2025-04-10T12:35:10Z", "vs_name":"test-web1.opco.something-8080", "status":"active"}
{"timestamp":"2025-04-10T12:35:15Z", "vs_name":"edge-juniper-uat.opco.sony-443", "status":"active"}

NOTE: 

If you use heavy forwarders, the props.conf and transforms.conf changes should be applied to the heavy forwarders instead of the indexers.