- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Regular expression is not working properly.. Pleas...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I need to have the first qualifier of a FQDN string. I have used the below mentioned query to do so. But it's not recognizing the ".". Could anyone please help me out here.
index=myindex_glbl
| rex field=Domain "^(?<Territory>.*)\."
| dedup Domain
| table Domain Territory
Here is the sample output:
Domain Territory
us.nam.ad.xyz.com us.nam.ad.xyz
crb.nam.ad.xyz.com crb.nam.ad.xyz
This is very strange behaviour. Can anybody suggest why this is happening?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this regex:
| rex field=Domain "^(?<Territory>[^\.]+)"
below regex will check till it found last "." instead of first while above regex will find first "."
| rex field=Domain "^(?<Territory>.*)\."
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this regex:
| rex field=Domain "^(?<Territory>[^\.]+)"
below regex will check till it found last "." instead of first while above regex will find first "."
| rex field=Domain "^(?<Territory>.*)\."
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks .. It's working... so if the delimiter character is mentioned after the ")", then it'll search for last occurance, right?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
not only when it is mentioned after ")" if you try | rex field=Domain "^(?<Territory>.*\.)" then also it will search for last occurance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
got it .. thnks.
Announcing Scheduled Export GA for Dashboard Studio
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!
